Threat Entry Updated 2025-04-23

CVE-2023-5089 - Defender Security Plugin

The Defender Security WordPress plugin before 4.1.0 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the login page, even when the hide login page functionality of the plugin is enabled.

PLUGIN Defender Security

CVE-2023-5089

MEDIUM CVSS 5.3 2023-10-16

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-04-08

CVE-2021-4425 - Defender Security Plugin

The Defender Security plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.6. This is due to missing or incorrect nonce validation on the verify_otp_login_time() function. This makes it possible for unauthenticated attackers to verify a one time login via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

PLUGIN Defender Security

CVE-2021-4425

MEDIUM CVSS 4.3 2023-07-12

Risk Score

Open Full Technical Breakdown