CVE-2026-13342

MediumCVSS 5.3

Published: 06/08/2026(UTC)Updated: 26/08/2026(UTC)Translated: 07/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

The Security Optimizer WordPress plugin from 1.5.8 to 1.6.4 does not correctly validate requests to its optional IP-based login restriction feature. This allows the restriction to be bypassed so that unauthenticated requests from non-allowlisted IP addresses can reach and use the login form, defeating the access control the administrator configured.

Risk Assessment

Attackers from unauthorized IP addresses can access the login form, increasing the risk of unauthorized access to the admin panel.

Recommendation

Update the Security Optimizer plugin to a version later than 1.6.4 to ensure proper validation of requests to the IP restriction feature.

Other vulnerabilities in Security Optimizer

CVE-2026-118185High
The Security Optimizer WordPress plugin before 1.6.9 does not limit the number of two-factor authentication codes that can be submitted for a pending login. This allows an attacker who already knows a user's password to brute force the second factor and take over the account.

Original NVD description (English source)

The Security Optimizer WordPress plugin from 1.5.8 to 1.6.4 does not correctly validate requests to its optional IP-based login restriction feature, allowing the restriction to be bypassed so that unauthenticated requests from non-allowlisted IP addresses can reach and use the login form, defeating the access control the administrator configured.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS