WordPress Shield Plugin Insecure Direct Object Reference Vulnerability in Google Authenticator Management

A vulnerability allowing Insecure Direct Object Reference (IDOR) has been identified in the WordPress Shield: Blocks Bots, Protects Users, and Prevents Security Breaches plugin, affecting all versions through 21.0.9. The issue arises in the MfaGoogleAuthToggle class, where insufficient validation on a user-controlled key allows authenticated attackers with Subscriber-level access or higher to disable Google Authenticator for any user.

Impact

Exploitation of this vulnerability allows authenticated users with Subscriber-level access and above to disable Google Authenticator for any user, potentially leading to unauthorized access or account takeover.

Remediation

Users can update to version 21.0.10 or a newer patched version to address this vulnerability.