The Shield Security plugin for WordPress contains a missing capability check on the MfaEmailDisable action. An attacker who can authenticate with a subscriber‑level or higher role can invoke this action and toggle the global Email 2‑factor authentication setting off. That change removes MFA enforcement for all users, exposing accounts to credential‑stuffing and other password‑based attacks. The flaw is a classic Missing Authorization weakness, allowing a privileged user to perform actions intended for administrators.

WordPress sites running Shield Security version 21.0.9 or earlier, developed by paultgoodchild. The affected product is the Shield Security: Blocks Bots, Protects Users, and Prevents Security Breaches plugin, any WordPress installation that has this plugin installed. Specific version details are up to and including 21.0.9.

The CVSS score of 4.3 reflects a moderate impact because the exploit requires an authenticated user with existing access, not a zero‑day. The EPSS score of less than 1% indicates low exploitation probability, and the vulnerability is not listed in CISA KEV. However, the attack vector is local; any user with Subscriber‑level or higher privileges on the site can disable MFA through the plugin’s settings page, raising the risk of credential compromise if MFA is the only defense against brute‑force attempts.