CVE-2026-119039 · Package
NO FIX YET
The Defender Security WordPress plugin before 6.4.1 takes the client IP address from a user-supplied value by default without checking it. An unauthenticated attacker can spoof that address to bypass login lockout and IP bans, impersonate an allowlisted address, and write false entries into the plugin's activity logs.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the Defender Security WordPress plugin before 6.4.1 are exposed, since the plugin trusts a client-supplied IP value by default. Attackers without an account can bypass IP-based login lockouts and bans, so sites relying on those controls for brute-force protection are most at risk. unknown whether sites behind a trusted proxy with a correct configuration are safe.
Not affected if version-6.4.1-or-later
Who cares defender-security, self-hosted, wordpress
wp plugin get defender-security --field=version6.4.1Unknown from the sources.
The Defender Security WordPress plugin before 6.4.1 does not verify that the client IP address it derives for its firewall and lockout decisions actually originates from a trusted source, trusting a user-supplied value by default, allowing unauthenticated attackers to spoof their IP address and evade IP-based protections such as login lockout and IP banning, impersonate an allowlisted address, and poison the Defender Security WordPress plugin before 6.4.1's activity logs.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.