CVE-2026-119039
MEDIUM
NVD
CVSS Score
5.3
Severity
MEDIUM
Published
Nov 12, 2026
Vendor
unknown
Description
The Defender Security WordPress plugin before 6.4.1 does not verify that the client IP address it derives for its firewall and lockout decisions actually originates from a trusted source, trusting a user-supplied value by default, allowing unauthenticated attackers to spoof their IP address and evade IP-based protections such as login lockout and IP banning, impersonate an allowlisted address, and poison the Defender Security WordPress plugin before 6.4.1's activity logs.