CVE-2025-15370CWE-639

Shield Security <= 21.0.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Disable Google Authenticator

Medium · published January 16, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
17.2
In the wild
Unconfirmed
What it is

The Shield: Blocks Bots, Protects Users, and Prevents Security Breaches plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 21.0.9 via the MfaGoogleAuthToggle class due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to disable Google Authenticator for any user.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00263 · 17.2th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-01-16T04:44Z
EPSS history
Timeline
  • 16 JAN 04:44Z
    Shield Security <= 21.0.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Disable Google Authenticator
    cvelistv5