Is CVE-2026-119039 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-119039 being exploited in the wild.

How severe is CVE-2026-119039?

Informational severity, published 12 November 2026.

Which products and versions are affected?

Wordpress Defender Security 4.9.0 through 6.4.0.

Is there a fix for CVE-2026-119039?

Yes: fixed in 6.4.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-119039 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-119039?

Check whether you run Wordpress Defender Security at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-119039: Defender Security WordPress plugin IP spoofing via Smart IP Detection

CVE-2026-119039 · Severity: info · Published 2026-11-12

Defender Security is a WordPress security plugin that enforces firewall rules and login lockout protections based on client IP addresses. The plugin before version 6.4.1 accepts user-supplied IP addresses without validating their origin, allowing attackers to spoof their IP address and bypass login lockouts, IP bans, and allowlist protections. Attackers can also falsify activity logs and impersonate trusted IP addresses.

Vendors: Wordpress.

Quick answers

Is CVE-2026-119039 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-119039 being exploited in the wild.
How severe is CVE-2026-119039?: Informational severity, published 12 November 2026.
Which products and versions are affected?: Wordpress Defender Security 4.9.0 through 6.4.0.
Is there a fix for CVE-2026-119039?: Yes: fixed in 6.4.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-119039 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-119039?: Check whether you run Wordpress Defender Security at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 6.4.1

Technical details

The plugin's Smart IP Detection feature fails to validate that derived client IP addresses originate from a trusted source, instead trusting user-supplied values by default. This CWE-290 spoofing vulnerability allows unauthenticated attackers to evade IP-based access controls, impersonate allowlisted addresses, and poison audit logs via trivial header manipulation.

Affected products

WordPress Defender Security 4.9.0 through 6.4.0

Timeline

2026-11-10: disclosed
2026-11-12: advisory

References

https://wpscan.com/vulnerability/58a8fb54-7dc6-4749-9467-6ce19a13f0ed/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.