Description
The Defender Security WordPress plugin before 6.4.1 does not verify that the client IP address it derives for its firewall and lockout decisions actually originates from a trusted source, trusting a user-supplied value by default, allowing unauthenticated attackers to spoof their IP address and evade IP-based protections such as login lockout and IP banning, impersonate an allowlisted address, and poison the Defender Security WordPress plugin before 6.4.1's activity logs.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Defender Security | 4.9.0 – < 6.4.1 | 6.4.1 |
References
- https://wpscan.com/vulnerability/58a8fb54-7dc6-4749-9467-6ce19a13f0ed/ exploit vdb-entry technical-description