CVE Watch12 de nov. de 2026

CVE-2026-119039

The Defender Security WordPress plugin before 6.4.1 does not verify that the client IP address it derives for its firewall and lockout deci

CVSS

5.3

Média

EPSS

—

KEV

—

Exploit Today

0-100

Publicado: 12 de nov. de 2026 · Última mod.: 12 de nov. de 2026 · CWE-290

EPSS · 30d

Ainda não há histórico EPSS suficiente.

Descrição técnica

The Defender Security WordPress plugin before 6.4.1 does not verify that the client IP address it derives for its firewall and lockout decisions actually originates from a trusted source, trusting a user-supplied value by default, allowing unauthenticated attackers to spoof their IP address and evade IP-based protections such as login lockout and IP banning, impersonate an allowlisted address, and poison the Defender Security WordPress plugin before 6.4.1's activity logs.

Referências oficiais

wpscan.comhttps://wpscan.com/vulnerability/58a8fb54-7dc6-4749-9467-6ce19a13f0ed/

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-1262147.2 ALT

—

——0A authentication bypass by spoofing vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12 may allow an authenticated administrator to escalate their privileges, bypass authorization controls or impersonate internal services via specially crafted requests to the GUI.18h CVE-2026-1261848.2 ALT

—

——0A authentication bypass by spoofing vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an attacker to disrupt the HA state.18h CVE-2026-1265429.8 CRÍ

55.5%

——17WWBN AVideo 6.5 through 29.7.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user via Hybridauth social login display names. Attackers can set their X, Facebook, Yahoo or LinkedIn display name to a victim's username and withhold email, causing login.json.php or oauth2.php to log them in as that account, including administrators, without a password.2d CVE-2026-40668—

9.7%

——3Authentication bypass by spoofing in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to request attestation reports for VMPL 0.2d CVE-2026-1199595.3 MÉD

23.5%

——7Improper access control in Windows Hyper-V allows an authorized attacker to perform spoofing locally.2d CVE-2026-1198217.8 ALT

23.5%

——7Improper authorization in Windows Network Connection Broker allows an authorized attacker to elevate privileges locally.2d