Vulnerability record · CVE-2023-6989 · published 5 February 2024
CVE-2023-6989: Shield Security WordPress plugin unauthenticated local file inclusion
Getshieldsecurity · Shield Security
The Shield Security plugin for WordPress is vulnerable to Local File Inclusion through the render_action_template parameter in all versions up to and including 18.5.9. An unauthenticated attacker can include and execute PHP files on the server, leading to arbitrary PHP code execution. This is a critical flaw because it requires no authentication or user interaction and can fully compromise the site.
Description
The Shield Security – Smart Bot Blocking & Intrusion Prevention Security plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 18.5.9 via the render_action_template parameter. This makes it possible for unauthenticated attacker to include and execute PHP files on the server, allowing the execution of any PHP code in those files.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS score is 9.8 (critical) with network exploitable, no authentication, and high impact, and EPSS is above the 99th percentile, indicating high likelihood of exploitation.
What it is
The Shield Security plugin for WordPress is vulnerable to Local File Inclusion through the render_action_template parameter in all versions up to and including 18.5.9. An unauthenticated attacker can include and execute PHP files on the server, leading to arbitrary PHP code execution. This is a critical flaw because it requires no authentication or user interaction and can fully compromise the site.
Impact
An attacker can execute arbitrary PHP code on the server, leading to full site compromise, data theft, or installation of backdoors. This can result in complete loss of confidentiality, integrity, and availability of the WordPress installation and its data.
Attack surface
The vulnerability is reachable over the network via the render_action_template parameter, with no authentication or user interaction required. Any remote attacker can send a crafted request to the vulnerable endpoint.
Exploitation
The CVE is not listed in CISA KEV, but EPSS indicates a high probability of exploitation (0.56567, 99th percentile). References include patch and third-party advisory tags, but no public exploit tags are present.
What to do
- Update the Shield Security plugin to a version later than 18.5.9 immediately.
- If patching is not possible, disable or remove the plugin until an update can be applied.
- Implement a web application firewall (WAF) rule to block requests containing path traversal or file inclusion patterns in the render_action_template parameter.
- Restrict file permissions and disable PHP execution in upload directories to limit the impact of file inclusion.
- Monitor for suspicious file changes or new PHP files in the WordPress installation.
Detection
- Search web server logs for requests with render_action_template parameter containing directory traversal sequences (e.g., ../) or absolute paths.
- Monitor for unexpected PHP file creation or modification in the WordPress directory, especially in uploads or cache folders.
- Use a file integrity monitoring tool to alert on changes to core WordPress files or plugin files.
- Review server logs for POST or GET requests to plugin endpoints with unusual parameter values.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2023-6989 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2023-6989), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
