# Defender Security <= 6.4.0 - Session Protection Idle Timeout and Session Lock Bypass

- **ID:** WPSEC-2026-2786
- **Plugin:** Defender Security – Malware Scanner, Login Security & Firewall (`defender-security`), https://wordpress.org/plugins/defender-security/
- **Affected versions:** from 5.2.0 before 6.4.1
- **Fixed in:** 6.4.1 (Update to 6.4.1 or later.)
- **Severity:** Medium 4.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-613
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-10)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/defender-security
- **Fix released:** 2026-11-09
- **Published:** 2026-11-10
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2786/

## Description

The Defender Security plugin for WordPress is vulnerable to Session Protection Bypass in versions 5.2.0 up to, and including, 6.4.0. This is due to the session lock and idle-timeout checks being skipped for AJAX requests and for any request whose URL contains the REST prefix 'wp-json/', including in a query string, so ordinary admin pages can be loaded without the checks. The IP address, hostname and browser locks also failed open for sessions that lack the stored value. In versions before 6.4.0 the idle timeout additionally fell back to the client-controlled 'wpdef_last_activity' cookie, applied no timeout when no activity record existed, and was skipped entirely whenever session lock properties were configured. This makes it possible for attackers holding a valid session cookie to keep using that session after the idle timeout, and from another IP address, hostname or browser, provided Session Protection is enabled for the user's role.

## References

- https://wpsec.com/vuln/WPSEC-2026-2786/
- https://plugins.svn.wordpress.org/defender-security/tags/6.4.1/
- https://wordpress.org/plugins/defender-security/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2786/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.