{"affected":[{"defaultStatus":"unaffected","product":"Defender Security","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"6.4.1","status":"affected","version":"4.9.0","versionType":"semver"}]}],"cveId":"CVE-2026-119039","cwes":["CWE-290"],"description":"The Defender Security  WordPress plugin before 6.4.1 does not verify that the client IP address it derives for its firewall and lockout decisions actually originates from a trusted source, trusting a user-supplied value by default, allowing unauthenticated attackers to spoof their IP address and evade IP-based protections such as login lockout and IP banning, impersonate an allowlisted address, and poison the Defender Security  WordPress plugin before 6.4.1's activity logs.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/58a8fb54-7dc6-4749-9467-6ce19a13f0ed/"}],"kev":null,"metrics":[],"modifiedAt":1794463207223,"publishedAt":1794463207223,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/58a8fb54-7dc6-4749-9467-6ce19a13f0ed/"}],"remediation":[],"revision":"a61686c578db285b72c12d8e9b46900ecbb2d704956290ca15ebf5b26fe5493d","sources":[{"modifiedAt":1794463207223,"name":"CNA: WPScan","retrievedAt":1794467310883,"url":"https://www.cve.org/CVERecord?id=CVE-2026-119039"}],"ssvc":null,"status":"published","title":"Defender Security 4.9.0 - 6.4.0 - Unauthenticated IP Address Spoofing via Smart IP Detection","updatedAt":1794467310883}