Skip to content
Fencer Intel
no cvss —

CVE-2026-119039 json

Defender Security 4.9.0 - 6.4.0 - Unauthenticated IP Address Spoofing via Smart IP Detection

published 4h ago modified 4h ago also EUVD-2026-124275

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no EPSS score yet
public exploits
0
none known

Summary

The Defender Security WordPress plugin before 6.4.1 does not verify that the client IP address it derives for its firewall and lockout decisions actually originates from a trusted source, trusting a user-supplied value by default, allowing unauthenticated attackers to spoof their IP address and evade IP-based protections such as login lockout and IP banning, impersonate an allowlisted address, and poison the Defender Security WordPress plugin before 6.4.1's activity logs.

Patch / fix

  • Unknown Defender Security 6.4.1

Is CVE-2026-119039 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Exploits and checks

  • wpscan.com https://wpscan.com/vulnerability/58a8fb54-7dc6-4749-9467-6ce19a13f0ed/ referenced PoC, tagged "exploit" by a source, unverified

Affected products

  • Unknown Defender Security

Classification

Weakness
  • CWE-290 Authentication Bypass by Spoofing
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.