Defender Security <= 6.3.0 - Unauthenticated IP Lockout Bypass via Plugin Route Nonces
- ID
- WPSEC-2026-2783
- Plugin
- Defender Security – Malware Scanner, Login Security & Firewall (defender-security)
- Affected
- from 4.6.0 before 6.4.0
- Remediation
- Update to 6.4.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-284
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-10
- Attack surface
- Defender Security on WPSec AttackSurface
- Fix released
- Published
Description
The Defender Security plugin for WordPress is vulnerable to an IP lockout bypass in versions 4.6.0 up to, and including, 6.3.0. This is due to the firewall's lockout handler (actions_for_blocked) allowing any request that carries the plugin's base action and a nonce valid for the 'route' given in the query string, on any URL rather than only on AJAX requests to the unlock routes. The lockout page shows such a nonce to the blocked visitor. This makes it possible for unauthenticated attackers whose IP address has been locked out to keep reaching the site, including the login form, which defeats lockouts such as the login brute-force protection.
References
- https://wpsec.com/vuln/WPSEC-2026-2783/
- https://plugins.svn.wordpress.org/defender-security/tags/6.4.0/
- https://wordpress.org/plugins/defender-security/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS