CVE-2023-47189 is a medium severity improper authentication flaw in the WPMU DEV Defender Security plugin through version 4.2.0, scored 5.3. The reference describes a bypass of the masked login area. Update Defender to a release later than 4.2.0 and confirm the fix in the changelog.
What's affected
The record says WPMU DEV Defender Security from n/a through 4.2.0 is affected. It describes improper authentication that allows accessing functionality not properly constrained by access control lists.
The reference is a Patchstack entry whose address calls it a masked login area view bypass. Defender's masking feature hides the standard login address, so this describes a way to see the masked login area without the intended restriction. That wording comes from the title of the page, as I could not read the page itself.
I could not confirm the first fixed version. The record says through 4.2.0, so any later release is the target, but check the plugin changelog for the exact one. The score is 5.3, with a network vector, no privileges and low confidentiality impact.
The NVD record was published on 2024-06-04, scores 5.3 (Medium), and carries the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. Weakness class: CWE-287.
How to check if you're exposed
Check the Defender version on each site.
wp plugin list --fields=name,status,version | grep -i defender
Or read it in the WordPress admin, on the Plugins page. A version of 4.2.0 or earlier is affected. Then confirm whether you use the login masking feature, and what your login address is, because that is the protection this flaw weakens. If you use masking as your main defense for the login page, add stronger controls.
What to do now
- Find every site running Defender Security and read its version.
- Update to a release later than 4.2.0, and read the changelog for the fix.
- Do not treat login masking as a security control by itself. Add multi-factor authentication for administrator accounts.
- Rate limit and monitor login attempts, whatever the login address is.
- Enable automatic plugin updates for security plugins in particular.
Why it matters
The weakness is CWE-287, improper authentication. Hiding a login page is obscurity, not authentication, and a bypass here exposes only a view of that area, which is why the score is medium.
Security plugins are a special case. They sit in front of the site and sites assume they work, so a flaw in them can make defenders blind to a problem. Keep them current and test the protections they promise. The record's KEV flag is false, so this CVE is not on the CISA Known Exploited Vulnerabilities list.
The best response is layered: patch the plugin, and make sure the login does not depend on the address being unknown.
Quick check
Does this give an attacker admin access?
The record and the reference title describe a bypass of the masked login area view with low confidentiality impact. They do not describe an account takeover.
Sources
Last reviewed: 19 October 2026.
