CVE-2023-0993mediumCWE-862

CVE-2023-0993: medium-severity vulnerability in paultgoodchild Shield: Blocks Bots, Protects…

Shield Security <= 17.0.17 - Missing Authorization

Published · Updated

Follow this CVE+ Monitor Shield: Blocks Bots, Protects Users, and Prevents Security Breaches

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.3epss 0.5%
The Shield Security plugin for WordPress is vulnerable to Missing Authorization on the 'theme-plugin-file' AJAX action in versions up to, and including, 17.0.17. This allows authenticated attackers to add arbitrary audit log entries indicating that a theme or plugin has been edited, and is also a vector for Cross-Site Scripting via CVE-2023-0992.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected products
paultgoodchild · Shield: Blocks Bots, Protects Users, and Prevents Security Breaches
Related CVEs — paultgoodchild Shield: Blocks Bots, Protects…

In the same product, most dangerous first.

CVE-2023-0992HIGHShield Security <= 17.0.17 - Unauthenticated Stored Cross-Site ScriptingEPSS 93.0%CVE-2023-6989CRITICALShield Security – Smart Bot Blocking & Intrusion Prevention Security <= 18.5.9 - Unauthenticated Local File InclusionEPSS 56.6%CVE-2026-0561MEDIUMShield Security <= 21.0.8 - Unauthenticated Reflected Cross-Site Scripting via 'message' ParameterEPSS 0.7%CVE-2026-0722MEDIUMShield Security <= 21.0.8 - Cross-Site Request Forgery to SQL InjectionEPSS 0.5%CVE-2025-15370MEDIUMShield Security <= 21.0.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Disable Google AuthenticatorEPSS 0.3%CVE-2025-14427MEDIUMShield Security: Blocks Bots, Protects Users, and Prevents Security Breaches <= 21.0.9 - Missing Authorization to Authenticated (Subscriber+) Email MFA UpdateEPSS 0.2%