Input validation vulnerability in Defender Security – Malware Scanner, Login Security & Firewall 2.4.6

The Defender Security Plugin for WordPress is vulnerable to a type of attack called Cross-Site Request Forgery in versions up to 2.4.6. This means that attackers who are not logged in can trick a website administrator into clicking on a link, which can allow them to verify a one-time login without the need for authentication. This is because the verify_otp_login_time() function is not correctly validating the nonce.