CVE-2023-6989
Last modified
CVE-2023-6989 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. The Shield Security – Smart Bot Blocking & Intrusion Prevention Security plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 18.5.9 via the render_action_template parameter. This makes it possible for unauthenticated attacker to include and execute PHP files on the server, allowing the execution of any PHP code in those files.. EPSS estimates a 56.57% chance of exploitation in the next 30 days.
Description
The Shield Security – Smart Bot Blocking & Intrusion Prevention Security plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 18.5.9 via the render_action_template parameter. This makes it possible for unauthenticated attacker to include and execute PHP files on the server, allowing the execution of any PHP code in those files.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Getshieldsecurity | Shield Security | < 18.5.10 |
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/063826cc-7ff3-4869-9831-f6a4a4bbe74c?source=cvePatch, Third Party Advisory
- https://www.wordfence.com/threat-intel/vulnerabilities/id/063826cc-7ff3-4869-9831-f6a4a4bbe74c?source=cvePatch, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-6989?
How severe is CVE-2023-6989?
How do I fix CVE-2023-6989?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-6983The Display custom fields in the frontend – Post and User Pr…4.3
- CVE-2023-6984The PowerPack Addons for Elementor (Free Widgets, Extensions…4.3
- CVE-2023-6985The 10Web AI Assistant – AI content writing assistant plugin…8.8
- CVE-2023-6986The EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wis…5.4
- CVE-2023-6987The String locator plugin for WordPress is vulnerable to Ref…6.1
- CVE-2023-6988The Colibri Page Builder plugin for WordPress is vulnerable …5.4
- CVE-2023-6990The Weaver Xtreme theme for WordPress is vulnerable to Store…5.4
- CVE-2023-6991The JSM file_get_contents() Shortcode WordPress plugin befor…8.8
- CVE-2023-6992Cloudflare version of zlib library was found to be vulnerabl…5.5
- CVE-2023-6993The Custom post types, Custom Fields & more plugin for WordP…6.4
- CVE-2023-6994The List category posts plugin for WordPress is vulnerable t…6.4
- CVE-2023-6996The Display custom fields in the frontend – Post and User Pr…8.8
Are you affected by CVE-2023-6989?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST