# Defender Security <= 6.3.0 - Unauthenticated IP Lockout Bypass via Plugin Route Nonces

- **ID:** WPSEC-2026-2783
- **Plugin:** Defender Security – Malware Scanner, Login Security & Firewall (`defender-security`), https://wordpress.org/plugins/defender-security/
- **Affected versions:** from 4.6.0 before 6.4.0
- **Fixed in:** 6.4.0 (Update to 6.4.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-284
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-10)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/defender-security
- **Fix released:** 2026-11-09
- **Published:** 2026-11-10
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2783/

## Description

The Defender Security plugin for WordPress is vulnerable to an IP lockout bypass in versions 4.6.0 up to, and including, 6.3.0. This is due to the firewall's lockout handler (actions_for_blocked) allowing any request that carries the plugin's base action and a nonce valid for the 'route' given in the query string, on any URL rather than only on AJAX requests to the unlock routes. The lockout page shows such a nonce to the blocked visitor. This makes it possible for unauthenticated attackers whose IP address has been locked out to keep reaching the site, including the login form, which defeats lockouts such as the login brute-force protection.

## References

- https://wpsec.com/vuln/WPSEC-2026-2783/
- https://plugins.svn.wordpress.org/defender-security/tags/6.4.0/
- https://wordpress.org/plugins/defender-security/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2783/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.