CVE-2026-119039— Defender Security 4.9.0 - 6.4.0 - Unauthenticated IP Address Spoofing via Smart IP Detection
Quick assessment
Affected
Unknown Defender Security
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Defender Security WordPress 插件 6.4.1 版本之前未验证其防火墙和锁定决策所依据的客户端 IP 地址是否真正来自可信来源，默认情况下信任由用户提供（即客户端提交）的 IP 值。这使得未认证的攻击者能够伪造其 IP 地址，从而规避基于 IP 的保护机制（例如登录锁定和 IP 封禁），冒充已列入白名单的地址，并污染 Defender Security WordPress 插件 6.4.1 版本之前的活动日志。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-119039
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Defender Security 4.9.0 - 6.4.0 - Unauthenticated IP Address Spoofing via Smart IP Detection
Source: CVE Program / CVE List V5
Vulnerability Description
The Defender Security WordPress plugin before 6.4.1 does not verify that the client IP address it derives for its firewall and lockout decisions actually originates from a trusted source, trusting a user-supplied value by default, allowing unauthenticated attackers to spoof their IP address and evade IP-based protections such as login lockout and IP banning, impersonate an allowlisted address, and poison the Defender Security WordPress plugin before 6.4.1's activity logs.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Defender Security | 4.9.0 ~ 6.4.1 | - |
|
II. Public POCs for CVE-2026-119039
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-119039
请登录查看更多情报信息。
Other References for CVE-2026-119039 (1)
-
https://wpscan.com/vulnerability/58a8fb54-7dc6-4749-9467-6ce19a13f0ed/ exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-11-12 · 21 CVEs total
| CVE-2026-121498 | Askany < 2.2.1 - Unauthenticated Chat Session Disclosure and Modification via IDOR | |
| CVE-2026-110072 | Photo Gallery by 10Web < 1.8.49 - Contributor+ Stored XSS via watermark_url Shortcode Attr | |
| CVE-2026-110041 | Crop-Thumbnails < 1.10.0 - Author+ Arbitrary Attachment Read and Overwrite via crop REST E | |
| CVE-2026-106027 | Oxygen MyData for WooCommerce 3.0.0 - 3.0.8 - Unauthenticated Arbitrary Order Completion v | |
| CVE-2026-110959 | Descope < 1.2.0 - Unauthenticated Account Takeover | |
| CVE-2026-118421 | WP Directory Kit < 1.6.3 - Listing Admin+ SQL Injection via 'order_by' Parameter | |
| CVE-2026-118531 | Directorist < 8.11.1 - Subscriber+ Listing Moderation Bypass via REST Status Update | |
| CVE-2026-123044 | ContentPen < 1.1.1 - Unauthenticated Stored XSS via API Key Disclosure | |
| CVE-2026-119040 | Defender Security < 6.4.1 - 2FA Bypass via Unthrottled OTP Verification | |
| CVE-2026-122003 | Abilities Bridge < 1.4.2 - Administrator Account Creation via CSRF | |
| CVE-2026-76792 | User Verification 2.0.38 - 2.0.48 - Unauthenticated Account Takeover via Unthrottled OTP L | |
| CVE-2026-123092 | WP Remote Users Sync < 2.3.0 - Privilege Escalation to Administrator via 'meta' Sync Actio | |
| CVE-2026-124652 | Mine CloudVod < 2.6.6 - Subscriber+ Order Information Disclosure via IDOR | |
| CVE-2026-124653 | Mine CloudVod < 2.6.6 - Unauthenticated Cloud Storage Credential Disclosure | |
| CVE-2026-124647 | TI WooCommerce Wishlist < 2.0.7 - Unauthenticated SQLi via tinv_wishlistkey Cookie | |
| CVE-2026-124648 | TI WooCommerce Wishlist < 2.13.0 - Unauthenticated Wishlist Item Deletion via Share Key | |
| CVE-2026-124815 | Clockinator Lite < 1.1.0 - Unauthenticated SQLi via Record Deletion Actions | |
| CVE-2026-124814 | Ultimate Addons for Elementor Forms < 1.0.8 - Unauthenticated Arbitrary File Upload via 't | |
| CVE-2026-124817 | Clockinator Lite < 1.1.0 - Unauthenticated Leave Record Modification | |
| CVE-2026-124665 | Order Tracking < 3.6.2 - Unauthenticated Customer and Sales Rep Order History Disclosure v |
IV. Related Vulnerabilities
Same product: Defender Security
-
CVE-2026-119040
Defender Security < 6.4.1 - 2FA Bypass via Unthrottled OTP V -
CVE-2026-19225
Defender Security < 6.2.0 - Admin+ Network-Wide RCE via Hub -
CVE-2024-37444
WordPress Defender plugin <= 4.7.1 - Broken Access Control v -
CVE-2023-47189
WordPress Defender Security plugin <= 4.2.0 - Masked Login A -
CVE-2024-25595
WordPress Defender Security plugin <= 4.4.1 - IP Restriction
Same vendor: Unknown
-
CVE-2026-76792
User Verification 2.0.38 - 2.0.48 - Unauthenticated Account -
CVE-2026-124665
Order Tracking < 3.6.2 - Unauthenticated Customer and Sales -
CVE-2026-124817
Clockinator Lite < 1.1.0 - Unauthenticated Leave Record Modi -
CVE-2026-124814
Ultimate Addons for Elementor Forms < 1.0.8 - Unauthenticate -
CVE-2026-124815
Clockinator Lite < 1.1.0 - Unauthenticated SQLi via Record D