{
 "id": "WPSEC-2026-2783",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2783/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2783/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2783/index.md",
 "title": "Defender Security <= 6.3.0 - Unauthenticated IP Lockout Bypass via Plugin Route Nonces",
 "description": "The Defender Security plugin for WordPress is vulnerable to an IP lockout bypass in versions 4.6.0 up to, and including, 6.3.0. This is due to the firewall's lockout handler (actions_for_blocked) allowing any request that carries the plugin's base action and a nonce valid for the 'route' given in the query string, on any URL rather than only on AJAX requests to the unlock routes. The lockout page shows such a nonce to the blocked visitor. This makes it possible for unauthenticated attackers whose IP address has been locked out to keep reaching the site, including the login form, which defeats lockouts such as the login brute-force protection.",
 "plugin": {
  "slug": "defender-security",
  "name": "Defender Security",
  "full_name": "Defender Security – Malware Scanner, Login Security & Firewall",
  "wordpress_org": "https://wordpress.org/plugins/defender-security/",
  "advisories_url": "https://wpsec.com/vuln/plugin/defender-security/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/defender-security"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-284"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "4.6.0",
    "from_inclusive": true,
    "to": "6.4.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 4.6.0 before 6.4.0"
  ]
 },
 "introduced_in": "4.6.0",
 "fixed_in": "6.4.0",
 "remediation": "Update to 6.4.0 or later.",
 "fix_released": "2026-11-09T09:03:33+00:00",
 "published": "2026-11-10T09:43:43+00:00",
 "updated": "2026-11-09T23:36:12.685094+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2783/",
  "https://plugins.svn.wordpress.org/defender-security/tags/6.4.0/",
  "https://wordpress.org/plugins/defender-security/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/defender-security",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-10"
 }
}