Defender Security <= 6.3.0 - Authenticated (Subscriber+) Username Enumeration and WebAuthn Credential ID Exposure via Credential Request Options
- ID
- WPSEC-2026-2782
- Plugin
- Defender Security – Malware Scanner, Login Security & Firewall (defender-security)
- Affected
- from 3.0.0 before 6.4.0
- Remediation
- Update to 6.4.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-204
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-10
- Attack surface
- Defender Security on WPSec AttackSurface
- Fix released
- Published
Description
The Defender Security plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'defender_webauthn_get_option' AJAX action in versions 3.0.0 up to, and including, 6.3.0. This is due to the handler looking up the target account from the posted username alone, without binding the request to the logged-in user or to a login attempt that has already passed the password check. This makes it possible for authenticated attackers with subscriber-level access and above, when two-factor authentication is enabled for their role, to find out whether usernames exist and to retrieve the WebAuthn credential identifiers registered by other users. Anyone who has reached the two-factor login screen can do the same while logged out.
References
- https://wpsec.com/vuln/WPSEC-2026-2782/
- https://plugins.svn.wordpress.org/defender-security/tags/6.4.0/
- https://wordpress.org/plugins/defender-security/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS