CVE-2026-119039: falha de média gravidade em Defender Security
Defender Security 4.9.0 - 6.4.0 - Unauthenticated IP Address Spoofing via Smart IP Detection
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.1%
The Defender Security WordPress plugin before 6.4.1 does not verify that the client IP address it derives for its firewall and lockout decisions actually originates from a trusted source, trusting a user-supplied value by default, allowing unauthenticated attackers to spoof their IP address and evade IP-based protections such as login lockout and IP banning, impersonate an allowlisted address, and poison the Defender Security WordPress plugin before 6.4.1's activity logs.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
Unknown · Defender SecurityCVEs relacionadas — Defender Security
No mesmo produto, das mais perigosas para as menos.
CVE-2023-5089MEDIUMDefender Security < 4.1.0 - Protection Bypass (Hidden Login Page)EPSS 2.5%CVE-2026-19225MEDIUMDefender Security < 6.2.0 - Admin+ Network-Wide RCE via Hub Connector on MultisiteEPSS 0.5%CVE-2026-119040HIGHDefender Security < 6.4.1 - 2FA Bypass via Unthrottled OTP VerificationEPSS 0.2%