CVE-2026-19225: Defender Security < 6.2.0 - Admin+ Network-Wide RCE via Hub Connector on Multisite
The Defender Security WordPress plugin before 6.2.0 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Defender Security (WordPress plugin)to a version that resolves this vulnerability.Fixed in 6.2.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An administrator of any individual site within a WordPress multisite network can exploit it. The issue involves a network-wide setting that should be limited to network administrators.
Are single-site WordPress installations affected?
The described impact applies to WordPress multisite networks because it relies on a single-site administrator changing a network-wide setting. The provided information does not indicate an impact on non-multisite installations.
What access does an attacker need?
The attacker needs administrator-level access on at least one site in the multisite network. No network administrator role is required according to the description.
What is the impact if exploitation succeeds?
A compromised or malicious site administrator can execute arbitrary code across the entire multisite network, rather than being limited to their own site.
What version addresses the issue?
The issue affects Defender Security versions before 6.2.0. Updating to version 6.2.0 or later addresses the affected version range described.