Skip to content
Sign in
6.6 Medium

CVE-2026-19225 The Defender Security WordPress plugin before 6.2.0 does not restrict a network-wide setting to network administrators,…

Description

The Defender Security WordPress plugin before 6.2.0 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network.

Affected products and versions

Product Affected versions Fixed in
Defender Security 5.0 5.0.0 → < 6.2.0 6.2.0

Other CVEs of Defender Security

The 2 CVEs of Defender Security →
CVE-2023-5089 The Defender Security WordPress plugin before 4.1.0 does not prevent redirects to the login page via the auth_redirect… 5.3 Medium
Track this CVE