Defender Security <= 6.2.4 - Unauthenticated Privilege Escalation via Account Takeover in Masked Login Password Reset
- ID
- WPSEC-2026-0303
- Plugin
- Defender Security – Malware Scanner, Login Security & Firewall (defender-security)
- Affected
- from 2.5.5 before 6.3.0
- Remediation
- Update to 6.3.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- Weakness
- CWE-640
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- Defender Security on WPSec AttackSurface
- Fix released
- Published
Description
The Defender Security plugin for WordPress is vulnerable to Account Takeover in versions 2.5.5 up to, and including, 6.2.4 due to the Mask Login password reset handler storing the validated login and reset key in a single site-wide transient that is not bound to the browser that opened the reset link. This makes it possible for unauthenticated attackers to set a new password for another user, including an administrator, by submitting the reset form within about two minutes after that user opens a valid password reset link. Exploitation requires the Mask Login feature to be enabled on a site the plugin detects as hosted on Flywheel, and the attacker to know the masked login URL.
References
- https://wpsec.com/vuln/WPSEC-2026-0303/
- https://plugins.svn.wordpress.org/defender-security/tags/6.3.0/
- https://wordpress.org/plugins/defender-security/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS