CVE-2023-6989: Getshieldsecurity Shield Security

Critical severity, CVSS 9.8. EPSS: 56.6% chance of exploitation in the next 30 days.

The Shield Security – Smart Bot Blocking & Intrusion Prevention Security plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 18.5.9 via the render_action_template parameter. This makes it possible for unauthenticated attacker to include and execute PHP files on the server, allowing the execution of any PHP code in those files.

Affected products

• Getshieldsecurity Shield Security: before 18.5.10 (fixed in 18.5.10)

Published 2024-02-05. Last modified 2026-06-17.