The Shield Security WordPress plugin contains a flaw that allows the nonce verification check to be bypassed by passing a user‑supplied parameter to the isNonceVerifyRequired function. This bypass turns Cross‑Site Request Forgery into an unauthenticated SQL injection vector, letting an attacker run arbitrary database queries and exfiltrate sensitive information, as described by CWE‑89.

The vulnerability affects the Shield Security plugin, developed by paultgoodchild:Shield, in all released versions up to and including 21.0.8. Users running these versions should verify the installed version and consider immediate remediation.

With a CVSS score of 6.5, the flaw is considered moderate severity. The EPSS value is below 1 % and the issue is not listed in the CISA KEV catalog, suggesting a low current exploitation probability. However, because the attack does not require authentication and can be executed with a forged request that tricks an administrator, the potential impact remains significant. The likely attack path would involve an attacker sending a crafted request to the site and luring an admin or trusted user into clicking a malicious link, thereby triggering the SQL injection.