CVE-2026-119039: Defender Security 4.9.0 - 6.4.0 - Unauthenticated IP Address Spoofing via Smart IP Detection

Published Nov 12, 2026

Updated

The Defender Security WordPress plugin before 6.4.1 does not verify that the client IP address it derives for its firewall and lockout decisions actually originates from a trusted source, trusting a user-supplied value by default, allowing unauthenticated attackers to spoof their IP address and evade IP-based protections such as login lockout and IP banning, impersonate an allowlisted address, and poison the Defender Security WordPress plugin before 6.4.1's activity logs.

Event History

Nov 12, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker only needs to be able to send requests to the affected WordPress site. No authentication is required, because the plugin trusts a user-supplied client IP value by default.

Are sites using the default configuration affected?

Yes. Smart IP Detection trusts a user-supplied value by default without verifying that it came from a trusted source, affecting firewall, lockout, allowlist, ban, and activity-log decisions.

What protections can be bypassed?

An attacker can spoof their apparent IP address to evade IP-based login lockouts and IP bans, or impersonate an allowlisted address. They can also poison the plugin's activity logs by causing activity to be attributed to a spoofed address.

How can I determine whether my site is affected?

Check whether Defender Security is installed at a version before 6.4.1. Sites using Smart IP Detection are affected when the client IP value used for security decisions can be supplied by an untrusted requester.

CVE-2026-119039: Defender Security 4.9.0 - 6.4.0 - Unauthenticated IP Address Spoofing via Smart IP Detection

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

Are sites using the default configuration affected?

What protections can be bypassed?

How can I determine whether my site is affected?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

Are sites using the default configuration affected?

What protections can be bypassed?

How can I determine whether my site is affected?