The Shield plugin for WordPress suffers from an insecure direct object reference in the class that toggles Google Authenticator. An attacker who has any authenticated role at the Subscriber level or higher can supply a user-controlled key and bypass the authorization check, enabling them to turn off two-factor authentication for any account. This action removes a critical protective factor and allows the attacker convenient foothold for subsequent account compromise.

The vulnerability affects the Shield: Blocks Bots, Protects Users, and Prevents Security Breaches WordPress plugin, specifically all releases up to and including version 21.0.9.

The CVSS score of 4.3 indicates a moderate impact, and the EPSS score of less than 1% signals a low probability of exploitation at the time of analysis. The vulnerability requires that an attacker already be logged in with Subscriber‑level rights or higher, so any breach would need prior credential compromise. Because disabling MFA removes an essential authentication barrier, the potential damage is significant even though it is not a remote code execution flaw. The issue is not listed in the CISA KEV catalog, implying no widespread exploitation has been documented yet. However, the ability to remove MFA is a valuable capability for attackers, warranting prompt remediation.