CVE-2026-19225: CWE-94 Improper Control of Generation of Code ('Code Injection') in Defender Security

The Defender Security WordPress plugin versions before 6.2.0 contain a code injection vulnerability (CWE-94) where a network-wide setting is not properly restricted to network administrators. This flaw allows an administrator of any single site within a multisite WordPress network to execute arbitrary code across the entire network, potentially compromising all sites. The vulnerability is identified as CVE-2026-19225 and affects version 5.0.0 of the plugin. The CVSS v3.1 base score is 6.6, reflecting a medium severity with network attack vector, high attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker with administrator privileges on any single site in a multisite WordPress network can execute arbitrary code across the entire network, potentially leading to full compromise of all sites within the network. This includes unauthorized access, data modification, and disruption of services.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 6.2.0, upgrading to version 6.2.0 or later is likely the intended remediation once available. Until then, restrict administrator privileges carefully and monitor for updates from the vendor.