Defender Security <= 6.4.0 - Session Protection Idle Timeout and Session Lock Bypass
- ID
- WPSEC-2026-2786
- Plugin
- Defender Security – Malware Scanner, Login Security & Firewall (defender-security)
- Affected
- from 5.2.0 before 6.4.1
- Remediation
- Update to 6.4.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-613
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-10
- Attack surface
- Defender Security on WPSec AttackSurface
- Fix released
- Published
Description
The Defender Security plugin for WordPress is vulnerable to Session Protection Bypass in versions 5.2.0 up to, and including, 6.4.0. This is due to the session lock and idle-timeout checks being skipped for AJAX requests and for any request whose URL contains the REST prefix 'wp-json/', including in a query string, so ordinary admin pages can be loaded without the checks. The IP address, hostname and browser locks also failed open for sessions that lack the stored value. In versions before 6.4.0 the idle timeout additionally fell back to the client-controlled 'wpdef_last_activity' cookie, applied no timeout when no activity record existed, and was skipped entirely whenever session lock properties were configured. This makes it possible for attackers holding a valid session cookie to keep using that session after the idle timeout, and from another IP address, hostname or browser, provided Session Protection is enabled for the user's role.
References
- https://wpsec.com/vuln/WPSEC-2026-2786/
- https://plugins.svn.wordpress.org/defender-security/tags/6.4.1/
- https://wordpress.org/plugins/defender-security/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS