CVE-2023-0993

MEDIUM 4.3CVE-2023-0993 · Published 09/06/2023 · updated 17/06/2026

Package	Affected versions	Patched versions
shield security getshieldsecurity	`≤ 17.0.17`	No fix yet

Description

The Shield Security plugin for WordPress is vulnerable to Missing Authorization on the 'theme-plugin-file' AJAX action in versions up to, and including, 17.0.17. This allows authenticated attackers to add arbitrary audit log entries indicating that a theme or plugin has been edited, and is also a vector for Cross-Site Scripting via CVE-2023-0992.

References

plugins.trac.wordpress.org/changeset · Patch
wordpress.org/plugins/wp-simple-firewall · Product
wordfence.com/blog/2023/04/multiple-vulnerabilities-patched-in-shield-security
wordfence.com/threat-intel/vulnerabilities/id/674461ad-9b61-48c4-af2a-5dfcaeb38215 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free