CVE-2023-5089

The Defender Security WordPress plugin (pre-4.1.0) fails to block redirects to the login page via WordPress auth_redirect, allowing unauthenticated visitors to access the login page even when the plugin’s hide-login feature is enabled. Affected product/version: Defender Security