CVE-2026-119039

MediumCVSS 5.3/10Last modified Nov 12, 2026

Description

The Defender Security WordPress plugin before 6.4.1 does not verify that the client IP address it derives for its firewall and lockout decisions actually originates from a trusted source, trusting a user-supplied value by default, allowing unauthenticated attackers to spoof their IP address and evade IP-based protections such as login lockout and IP banning, impersonate an allowlisted address, and poison the Defender Security WordPress plugin before 6.4.1's activity logs.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-290

Affected software

No affected versions have been published.

Timeline

Published: Nov 12, 2026
Last modified: Nov 12, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-119045.3IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 and IBM Verify Identity Access Container CVE-2026-1190407.5The Defender Security WordPress plugin before 6.4.1 does not limit the number of failed two-factor authentication attempts in its default c CVE-2026-1190484.2JeeSite 5.11.0 through 5.19.1 contains an insecure direct object reference vulnerability in the AI CMS chat module that allows authenticated CVE-2026-1190497.6FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authenticated users to claim another user's existing mailbo CVE-2026-119054.3The Elementor Website Builder – more than just a page builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all ve CVE-2026-1190508.1Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows attackers to invoke arbitrary pandas functions by CVE-2026-1190515.9flat through 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten() that allows attackers to create huge sparse arr CVE-2026-1190527.5llama.cpp b2877 before b11935 contains an uncaught exception vulnerability in the ggml-rpc server that allows unauthenticated remote attacke CVE-2026-1190535.3lwIP 2.0.0 through 2.2.1 built with the SNMP agent contains an out-of-bounds read vulnerability in snmp_pbuf_stream_writeto() that bounds co CVE-2026-1190545.4Multiple Pages Generator by Themeisle before 4.2.5 contains a stored cross-site scripting vulnerability that allows Contributor-level users CVE-2026-1190554.6CWE- 416: Use After Free vulnerability exists that could cause arbitrary code execution when a local attacker could trick the end user to op CVE-2026-1190594.3The Content Egg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing per-post capability check on the aj