{"id":"CVE-2026-119039","kind":"vulnerability","aliases":["CVE-2026-119039"],"related":[],"title":"Defender Security WordPress plugin trusts spoofable client IP headers","description":"The Defender Security  WordPress plugin before 6.4.1 does not verify that the client IP address it derives for its firewall and lockout decisions actually originates from a trusted source, trusting a user-supplied value by default, allowing unauthenticated attackers to spoof their IP address and evade IP-based protections such as login lockout and IP banning, impersonate an allowlisted address, and poison the Defender Security  WordPress plugin before 6.4.1's activity logs.","summary":"The Defender Security WordPress plugin before 6.4.1 takes the client IP address from a user-supplied value by default without checking it. An unauthenticated attacker can spoof that address to bypass login lockout and IP bans, impersonate an allowlisted address, and write false entries into the plugin's activity logs.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["defender-security","package","self-hosted","wordpress"],"not_affected_if":["version-6.4.1-or-later"],"how_to_check":"- Check the installed Defender Security version in the WordPress admin plugin list or with `wp plugin get defender-security --field=version`\n- Look for a version below `6.4.1`","fix":null,"status":"open","published_at":"2026-11-12T06:17:12+00:00","first_seen_at":"2026-11-12T06:36:51+00:00","triaged_at":"2026-11-12T06:38:03+00:00","updated_at":"2026-11-12T06:38:03+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-12T06:38:03Z","model":"claude-haiku-5-5","output":{"fix":"- Defender Security (WordPress plugin): upgrade to `6.4.1` or later","reach":"internet","title":"Defender Security WordPress plugin trusts spoofable client IP headers","impact":"low","summary":"The Defender Security WordPress plugin before 6.4.1 takes the client IP address from a user-supplied value by default without checking it. An unauthenticated attacker can spoof that address to bypass login lockout and IP bans, impersonate an allowlisted address, and write false entries into the plugin's activity logs.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","defender-security","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"attacker evades login lockout and bans, poisons logs","analyst_note":"","how_to_check":"- Check the installed Defender Security version in the WordPress admin plugin list or with `wp plugin get defender-security --field=version`\n- Look for a version below `6.4.1`\n- unknown whether proxy-header settings change exposure","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-6.4.1-or-later"],"who_is_affected":"Sites running the Defender Security WordPress plugin before 6.4.1 are exposed, since the plugin trusts a client-supplied IP value by default. Attackers without an account can bypass IP-based login lockouts and bans, so sites relying on those controls for brute-force protection are most at risk. unknown whether sites behind a trusted proxy with a correct configuration are safe.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000758,"input_tokens":4599,"output_tokens":596,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-119039':12A,15A '-2026':11A,14A '6.4.1':30B,81C,145C 'activ':73B,147C 'actual':98C 'address':35B,53B,64B,89C,119C,136C 'allow':112C 'allowlist':63B,135C 'attack':49B,114C 'ban':60B,132C 'base':124C 'bypass':55B 'check':45B 'client':7A,33B,87C 'cve':10A,13A 'decis':97C 'default':43B,111C 'defend':1A,17B,25B,76C,140C 'defender-secur':16B 'deriv':91C 'entri':68B 'evad':121C 'fals':67B 'firewal':94C 'header':9A 'host':22B 'imperson':61B,133C 'ip':8A,34B,59B,88C,118C,123C,131C 'ip-bas':122C 'lockout':57B,96C,129C 'log':74B,148C 'login':56B,128C 'origin':99C 'packag':19B 'plugin':4A,28B,71B,79C,143C 'poison':138C 'protect':125C 'secur':2A,18B,26B,77C,141C 'self':21B 'self-host':20B 'sourc':103C 'spoof':51B,116C 'spoofabl':6A 'suppli':40B,108C 'take':31B 'trust':5A,102C,104C 'unauthent':48B,113C 'user':39B,107C 'user-suppli':38B,106C 'valu':41B,109C 'verifi':84C 'without':44B 'wordpress':3A,23B,27B,78C,142C 'write':66B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Defender Security WordPress plugin before 6.4.1 are exposed, since the plugin trusts a client-supplied IP value by default. Attackers without an account can bypass IP-based login lockouts and bans, so sites relying on those controls for brute-force protection are most at risk. unknown whether sites behind a trusted proxy with a correct configuration are safe.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["defendersecurity","medium","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-119039':12A,15A '-2026':11A,14A 'client':7A 'cve':10A,13A 'defend':1A 'header':9A 'ip':8A 'plugin':4A 'secur':2A 'spoofabl':6A 'trust':5A 'wordpress':3A","search_b":"'6.4.1':30B 'activ':73B 'address':35B,53B,64B 'allowlist':63B 'attack':49B 'ban':60B 'bypass':55B 'check':45B 'client':33B 'default':43B 'defend':17B,25B 'defender-secur':16B 'entri':68B 'fals':67B 'host':22B 'imperson':61B 'ip':34B,59B 'lockout':57B 'log':74B 'login':56B 'packag':19B 'plugin':28B,71B 'secur':18B,26B 'self':21B 'self-host':20B 'spoof':51B 'suppli':40B 'take':31B 'unauthent':48B 'user':39B 'user-suppli':38B 'valu':41B 'without':44B 'wordpress':23B,27B 'write':66B","search_c":"'6.4.1':81C,145C 'activ':147C 'actual':98C 'address':89C,119C,136C 'allow':112C 'allowlist':135C 'attack':114C 'ban':132C 'base':124C 'client':87C 'decis':97C 'default':111C 'defend':76C,140C 'deriv':91C 'evad':121C 'firewal':94C 'imperson':133C 'ip':88C,118C,123C,131C 'ip-bas':122C 'lockout':96C,129C 'log':148C 'login':128C 'origin':99C 'plugin':79C,143C 'poison':138C 'protect':125C 'secur':77C,141C 'sourc':103C 'spoof':116C 'suppli':108C 'trust':102C,104C 'unauthent':113C 'user':107C 'user-suppli':106C 'valu':109C 'verifi':84C 'wordpress':78C,142C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T06:17:12+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119039","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119039","severity":null,"published_at":"2026-11-12T06:17:12+00:00","modified_at":"2026-11-12T06:17:12+00:00","first_seen_at":"2026-11-12T06:36:51+00:00","fetched_at":"2026-11-12T06:36:51+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}