CVE-2026-119039 Defender Security 4.9.0 - 6.4.0 - Unauthenticated IP Address Spoofing via Smart IP Detection

The Defender Security WordPress plugin before 6.4.1 does not verify that the client IP address it derives for its firewall and lockout decisions actually originates from a trusted source, trusting a user-supplied value by default, allowing unauthenticated attackers to spoof their IP address and...

CVE-2026-119039

The Defender Security WordPress plugin (versions before 6.4.1 ) is vulnerable to unauthenticated IP address spoofing due to improper validation of the client IP address used for firewall and lockout decisions. The plugin trusts a user-supplied value by default without verifying its source. This a...