CVE-2026-19225mediumCWE-94

CVE-2026-19225: medium-severity vulnerability in Defender Security

Defender Security < 6.2.0 - Admin+ Network-Wide RCE via Hub Connector on Multisite

Published

Follow this CVE+ Monitor Defender Security

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 6.6epss 0.5%
The Defender Security WordPress plugin before 6.2.0 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
Unknown · Defender Security
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Defender Security

In the same product, most dangerous first.

CVE-2023-5089MEDIUMDefender Security < 4.1.0 - Protection Bypass (Hidden Login Page)EPSS 2.5%