PT-2026-20628 · WordPress · Shield Security

Dmitry Ignatyev · Published 2026-02-19 · Updated 2026-02-19 · CVE-2026-0722

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Shield Security plugin for WordPress versions prior to 21.0.9

Description The Shield Security plugin for WordPress is susceptible to Cross-Site Request Forgery. This occurs because the plugin does not properly verify nonces, specifically allowing bypass via a user-supplied parameter in the isNonceVerifyRequired() function. This enables unauthenticated attackers to potentially execute SQL injection attacks and extract sensitive information from the database through a forged request, provided they can trick a site administrator into performing an action.

Recommendations Update the Shield Security plugin to version 21.0.9 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-0722

Affected Products

Shield Security

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-0722 · Security Note
• https://research.cleantalk.org/cve-2026-0722 · Note
• https://twitter.com/CVEnew/status/2024360203802812886 · Twitter Post
• https://t.me/CVEtracker/45084 · Telegram Post
• https://plugins.trac.wordpress.org/browser/wp-simple-firewall/tags/21.0.8/src/lib/src/ActionRouter/Actions/BaseAction.php#L125 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3439494%40wp-simple-firewall&new=3439494%40wp-simple-firewall&sfp_email=&sfph_mail= · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/f53d9579-56e9-41aa-b6b7-2472734ee719?source=cve · Note
• https://plugins.trac.wordpress.org/browser/wp-simple-firewall/tags/21.0.8/src/lib/src/ActionRouter/CaptureAjaxAction.php#L42 · Note
• https://plugins.trac.wordpress.org/browser/wp-simple-firewall/tags/21.0.8/src/lib/src/Tables/DataTables/LoadData/Traffic/BuildTrafficTableData.php#L114 · Note