CVE-2026-13342CWE-693

CVE-2026-13342

Medium · published August 7, 2026

CVSS v3.1

5.3

EPSS

Percentile

27.0

In the wild

Unconfirmed

What it is

The Security Optimizer WordPress plugin from 1.5.8 to 1.6.4 does not correctly validate requests to its optional IP-based login restriction feature, allowing the restriction to be bypassed so that unauthenticated requests from non-allowlisted IP addresses can reach and use the login form, defeating the access control the administrator configured.

The record

Technical detail

CVSS v3.1: 5.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00347 · 27.0th percentile
Weakness: CWE-693 · Protection Mechanism Failure
Published: 2026-08-07T02:16Z

References (1)

https://wpscan.com/vulnerability/ab14b11c-96ab-4d07-89e0-1d67e4314267/ · [email protected]

EPSS history

Timeline

06 AUG 17:07Z
Security Optimizer – The All-In-One Protection Plugin < 1.6.5 - Login Access IP Allowlist Bypass via post_password
cvelistv5