CVE-2023-6989

2024-02-0522:15:58

CWE-22

[email protected]

web.nvd.nist.gov

cve-2023-6989

smart bot blocking

intrusion prevention

local file inclusion

wordpress security

unauthenticated attack

php execution

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.242

Percentile

96.7%

JSON

The Shield Security – Smart Bot Blocking & Intrusion Prevention Security plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 18.5.9 via the render_action_template parameter. This makes it possible for unauthenticated attacker to include and execute PHP files on the server, allowing the execution of any PHP code in those files.

Affected configurations

Nvd

Node

getshieldsecurityshield_securityRange<18.5.10wordpress

VendorProductVersionCPE
getshieldsecurityshield_security*cpe:2.3:a:getshieldsecurity:shield_security:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
getshieldsecurity	shield_security	*	cpe:2.3:a:getshieldsecurity:shield_security::::::wordpress::*

References

plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3013699%40wp-simple-firewall&new=3013699%40wp-simple-firewall&sfp_email=&sfph_mail=

www.wordfence.com/threat-intel/vulnerabilities/id/063826cc-7ff3-4869-9831-f6a4a4bbe74c?source=cve