CVE-2023-5089

The Defender Security WordPress plugin (pre-4.1.0) fails to block redirects to the login page via WordPress auth_redirect, allowing unauthenticated visitors to access the login page even when the plugin’s hide-login feature is enabled. Affected product/version: Defender Security

CVE-2023-51490

CVE-2023-51490 affects the WordPress Defender Security plugin by WPMU DEV, impacting Defender Security – Malware Scanner, Login Security & Firewall up to version 4.1.0. Root cause: Exposure of sensitive information to an unauthorized actor. The CVE is marked as patched in the sources. Remediation...

CVE-2021-4425

CVE-2021-4425 affects the Defender Security plugin for WordPress. The vulnerability is a Cross-Site Request Forgery due to missing or incorrect nonce validation in the verify_otp_login_time() function, across versions up to and including 2.4.6. This can allow unauthenticated attackers to verify a...