Defender Security CVE-2026-19225

Exploitation requires an authenticated WordPress site administrator account - not a network/super administrator - on a WordPress multisite installation running Defender Security plugin versions 5.0.0 through 6.1.x. Single-site WordPress installations are entirely unaffected. The attacker must possess or obtain valid site-admin credentials for at least one site on the target network; unauthenticated access is not possible given PR:H in the CVSS vector. Limiting factors include: the multisite deployment requirement (non-default WordPress configuration), the need for site-administrator-level credentials, and SSVC Automatable: no (no known path to mass unauthenticated scanning). The severity is bounded by how many untrusted site admins exist on a given network.

The NVD CVSS 3.1 score of 6.6 reflects meaningful constraints: PR:H (requires site administrator credentials) and AC:H (requires a WordPress multisite deployment, not a default single-site install). EPSS at 0.17% (6th percentile) and SSVC exploitation status of 'none' confirm no current observed exploitation activity, and SSVC Automatable: no indicates mass scanning and unauthenticated opportunistic exploitation are not feasible. However, SSVC's 'total' technical impact and the CVSS C:H/I:H/A:H triad reflect the severe downstream consequence - full network-wide code execution - if a site admin account is compromised or malicious. Notably, the NVD-supplied vector uses S:U (unchanged scope), which appears inconsistent with the description's explicit 'execute arbitrary code across the entire network'; a scope change designation (S:C) may be more accurate and would raise the base score. Defenders should verify this discrepancy with the vendor advisory. Net assessment: high priority for organizations operating Defender Security on multisite WordPress, but not a broad emergency given the required credentials and deployment specifics.

An attacker who controls or compromises a site-administrator account on any single blog or subdomain within a WordPress multisite network navigates to the Defender Security network-wide configuration panel, which is erroneously accessible without network-admin capability checks. The attacker modifies a code-influencing setting to inject a malicious payload, which is then evaluated and executed across all sites on the network, achieving full multi-tenant compromise from a single low-trust account. No public exploit code is known at time of analysis.