Threats tagged 'ghsa-2q88-889w-4vcf'

The Defender Security WordPress plugin versions before 6.4.1 do not limit the number of failed two-factor authentication attempts by default. This allows an attacker who already knows a user's password to brute-force the one-time authentication code, potentially bypassing the second factor of authentication.