title: Defender Security < 4.1.0 - Protection Bypass (Hidden Login Page)
description: The Defender Security WordPress plugin before 4.1.0 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the login page, even when the hide login page functionality of the plugin is enabled.
problem types: CWE-209 Generation of Error Message Containing Sensitive Information
affected:
{
vendor: Unknown
product: Defender Security
versions:
status: affected, versionType: custom, version: 0, lessThan: 4.1.0
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
}