TI-2023-00940 Aliases CVE-2023-0993 GHSA-5p6w-7m52-66g9

Shield Security <= 17.0.17 - Missing Authorization

LOW 21CWE-862Published 2023-06-09 · Updated 2026-04-08

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: None · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

The Shield Security plugin for WordPress is vulnerable to Missing Authorization on the 'theme-plugin-file' AJAX action in versions up to, and including, 17.0.17. This allows authenticated attackers to add arbitrary audit log entries indicating that a theme or plugin has been edited, and is also a vector for Cross-Site Scripting via CVE-2023-0992.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0055 46th percentileScored 2026-11-07

Fix Fixed Shield: Blocks Bots, Protects Users, and Prevents Security Breaches (paultgoodchild): 17.0.18

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
paultgoodchild	Shield: Blocks Bots, Protects Users, and Prevents Security Breaches	before 17.0.18	17.0.18	Patch available	CNA

Shield: Blocks Bots, Protects Users, and Prevents Security Breaches Vendorpaultgoodchild Affected before 17.0.18 Fixed in 17.0.18 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:getshieldsecurity:shield_security::::::wordpress::*	up to 17.0.17	Vulnerable	Getshieldsecurity

cpe:2.3:a:getshieldsecurity:shield_security:*:*:*:*:*:wordpress:*:* Versions up to 17.0.17 Vulnerable ·Getshieldsecurity

Remediation

Fix · CNA Shield: Blocks Bots, Protects Users, and Prevents Security Breaches (paultgoodchild) Fixed in 17.0.18

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2023-06-09
paultgoodchild Shield: Blocks Bots, Protects Users, and Prevents Security Breaches 17.0.18
2 records Highest priority Priority HIGH 1 HIGH, 1 LOW
Other records, highest priority first
- TI-2023-00939 Shield Security <= 17.0.17 - Unauthenticated Stored Cross-Site ScriptingPriority HIGH 81
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2023-0993
2026-10-03 Alias added: GHSA-5p6w-7m52-66g9

References

Patch 1

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2883864%40wp-simple-firewall%2Ftrunk&old=2883536%40wp-simple-firewall%2Ftrunk&sfp_email=&sfph_mail=

Advisory 1

https://www.wordfence.com/threat-intel/vulnerabilities/id/674461ad-9b61-48c4-af2a-5dfcaeb38215?source=cve

Other 2

TI-2026-83515 Stored cross-site scripting in Shield Security via request path CVSS 3.1HIGH 7.2
TI-2026-00509 Shield Security <= 21.0.8 - Cross-Site Request Forgery to SQL Injection CVSS 3.1MEDIUM 6.5
TI-2026-00363 Shield Security <= 21.0.8 - Unauthenticated Reflected Cross-Site Scripting via 'message' Parameter CVSS 3.1MEDIUM 6.1
TI-2025-14019 Shield Security <= 21.0.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Disable Google Authenticator CVSS 3.1MEDIUM 4.3
TI-2025-13178 Missing authorization in paultgoodchild Shield: Blocks Bots, Protects Users, and Prevents… CVSS 3.1MEDIUM 4.3
TI-2024-04046 Shield Security – Smart Bot Blocking & Intrusion Prevention Security <= 19.1.13 - Cross-Site Request Forgery CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences