CVE-2026-119039
Defender Security 4.9.0 - 6.4.0 - Unauthenticated IP Address Spoofing via Smart IP Detection
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Defender Security WordPress plugin before 6.4.1 does not verify that the client IP address it derives for its firewall and lockout decisions actually originates from a trusted source, trusting a user-supplied value by default, allowing unauthenticated attackers to spoof their IP address and evade IP-based protections such as login lockout and IP banning, impersonate an allowlisted address, and poison the Defender Security WordPress plugin before 6.4.1's activity logs.
| Vendor | unknown |
| Product | defender security |
| Published | Nov 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown defender security
Be the first to know when new unknown vulnerabilities affecting unknown defender security are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Defender Security
4.9.0 < 6.4.1
References
Credits
Karthik Ramakrishnan WPScan