{
 "id": "WPSEC-2026-2782",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2782/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2782/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2782/index.md",
 "title": "Defender Security <= 6.3.0 - Authenticated (Subscriber+) Username Enumeration and WebAuthn Credential ID Exposure via Credential Request Options",
 "description": "The Defender Security plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'defender_webauthn_get_option' AJAX action in versions 3.0.0 up to, and including, 6.3.0. This is due to the handler looking up the target account from the posted username alone, without binding the request to the logged-in user or to a login attempt that has already passed the password check. This makes it possible for authenticated attackers with subscriber-level access and above, when two-factor authentication is enabled for their role, to find out whether usernames exist and to retrieve the WebAuthn credential identifiers registered by other users. Anyone who has reached the two-factor login screen can do the same while logged out.",
 "plugin": {
  "slug": "defender-security",
  "name": "Defender Security",
  "full_name": "Defender Security – Malware Scanner, Login Security & Firewall",
  "wordpress_org": "https://wordpress.org/plugins/defender-security/",
  "advisories_url": "https://wpsec.com/vuln/plugin/defender-security/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/defender-security"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-204"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "3.0.0",
    "from_inclusive": true,
    "to": "6.4.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 3.0.0 before 6.4.0"
  ]
 },
 "introduced_in": "3.0.0",
 "fixed_in": "6.4.0",
 "remediation": "Update to 6.4.0 or later.",
 "fix_released": "2026-11-09T09:03:33+00:00",
 "published": "2026-11-10T09:43:43+00:00",
 "updated": "2026-11-09T23:36:12.685094+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2782/",
  "https://plugins.svn.wordpress.org/defender-security/tags/6.4.0/",
  "https://wordpress.org/plugins/defender-security/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/defender-security",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-10"
 }
}