CVE-2026-0722

The Shield Security plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 21.0.8. This is due to the plugin allowing nonce verification to be bypassed via user-supplied parameter in the 'isNonceVerifyRequired' function. This makes it possible for unauthenticated attackers to execute SQL injection attacks, extracting sensitive information from the database, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-89

• https://plugins.trac.wordpress.org/browser/wp-simple-firewall/tags/21.0.8/src/lib/src/ActionRouter/Actions/BaseAction.php#L125
• https://plugins.trac.wordpress.org/browser/wp-simple-firewall/tags/21.0.8/src/lib/src/ActionRouter/CaptureAjaxAction.php#L42
• https://plugins.trac.wordpress.org/browser/wp-simple-firewall/tags/21.0.8/src/lib/src/Tables/DataTables/LoadData/Traffic/BuildTrafficTableData.php#L114
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3439494%40wp-simple-firewall&new=3439494%40wp-simple-firewall&sfp_email=&sfph_mail=
• https://research.cleantalk.org/cve-2026-0722/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/f53d9579-56e9-41aa-b6b7-2472734ee719?source=cve

Published

Feb 19, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-0714A physical attack vulnerability exists in certain Moxa indus…6.8
• CVE-2026-0715Moxa Arm-based industrial computers running Moxa Industrial …6.8
• CVE-2026-0716A flaw was found in libsoup’s WebSocket frame processing whe…4.8
• CVE-2026-0717The LottieFiles – Lottie block for Gutenberg plugin for Word…5.3
• CVE-2026-0718The Post Grid Gutenberg Blocks for News, Magazines, Blog Web…5.3
• CVE-2026-0719A flaw was identified in the NTLM authentication handling of…8.6
• CVE-2026-0723GitLab has remediated an issue in GitLab CE/EE affecting all…7.4
• CVE-2026-0724The WPlyr Media Block plugin for WordPress is vulnerable to …4.4
• CVE-2026-0725The Integrate Dynamics 365 CRM plugin for WordPress is vulne…4.4
• CVE-2026-0726The Nexter Extension – Site Enhancements Toolkit plugin for …8.1
• CVE-2026-0727The Accordion and Accordion Slider plugin for WordPress is v…5.4
• CVE-2026-0728A security vulnerability has been detected in code-projects …7.2