{
 "id": "WPSEC-2026-2786",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2786/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2786/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2786/index.md",
 "title": "Defender Security <= 6.4.0 - Session Protection Idle Timeout and Session Lock Bypass",
 "description": "The Defender Security plugin for WordPress is vulnerable to Session Protection Bypass in versions 5.2.0 up to, and including, 6.4.0. This is due to the session lock and idle-timeout checks being skipped for AJAX requests and for any request whose URL contains the REST prefix 'wp-json/', including in a query string, so ordinary admin pages can be loaded without the checks. The IP address, hostname and browser locks also failed open for sessions that lack the stored value. In versions before 6.4.0 the idle timeout additionally fell back to the client-controlled 'wpdef_last_activity' cookie, applied no timeout when no activity record existed, and was skipped entirely whenever session lock properties were configured. This makes it possible for attackers holding a valid session cookie to keep using that session after the idle timeout, and from another IP address, hostname or browser, provided Session Protection is enabled for the user's role.",
 "plugin": {
  "slug": "defender-security",
  "name": "Defender Security",
  "full_name": "Defender Security – Malware Scanner, Login Security & Firewall",
  "wordpress_org": "https://wordpress.org/plugins/defender-security/",
  "advisories_url": "https://wpsec.com/vuln/plugin/defender-security/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/defender-security"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-613"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.8,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "5.2.0",
    "from_inclusive": true,
    "to": "6.4.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 5.2.0 before 6.4.1"
  ]
 },
 "introduced_in": "5.2.0",
 "fixed_in": "6.4.1",
 "remediation": "Update to 6.4.1 or later.",
 "fix_released": "2026-11-09T09:22:54+00:00",
 "published": "2026-11-10T09:43:43+00:00",
 "updated": "2026-11-09T23:36:09.962247+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2786/",
  "https://plugins.svn.wordpress.org/defender-security/tags/6.4.1/",
  "https://wordpress.org/plugins/defender-security/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/defender-security",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-10"
 }
}