CVE-2023-0993 Shield Security <= 17.0.17 - Missing Authorization

What is CVE-2023-0993?

CVE-2023-0993 is a medium-severity missing authorization vulnerability in paultgoodchild Shield: Blocks Bots, Protects Users, and Prevents Security Breaches, published on 9 Jun 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The Shield Security plugin for WordPress is vulnerable to Missing Authorization on the 'theme-plugin-file' AJAX action in versions up to, and including, 17.0.17. This allows authenticated attackers to add arbitrary audit log entries indicating that a theme or plugin has been edited, and is also a vector for Cross-Site Scripting via CVE-2023-0992.

Weakness: CWE-862

Which versions are affected by CVE-2023-0993?

It affects 1 product.

Products include Getshieldsecurity Shield Security.

How do I fix CVE-2023-0993?

No fix has been published for CVE-2023-0993 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2023-0993 being exploited?

There is no known exploitation of CVE-2023-0993 in the wild and no public exploit code.

Other vulnerabilities in paultgoodchild Shield: Blocks Bots, Protects Users, and Prevents Security Breaches

• CVE-2023-6989 Shield Security – Smart Bot Blocking & Intrusion Prevention Security <= 18.5.9 - Unauthenticated Local File Inclusion Critical 9.8
• CVE-2023-0992 Shield Security <= 17.0.17 - Unauthenticated Stored Cross-Site Scripting High 7.2
• CVE-2024-22163 WordPress Shield Security Plugin <= 18.5.7 is vulnerable to Cross Site Scripting (XSS) High 7.1
• CVE-2024-7313 Shield Security < 20.0.6 - Reflected XSS Medium 6.1
• CVE-2022-0211 Shield Security < 13.0.6 - Admin+ Stored Cross-Site Scripting Medium 4.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-5p6w-7m52-66g9.