CVE-2024-4344: 
WordPress vulnerability analysis and mitigation

The Shield Security – Smart Bot Blocking & Intrusion Prevention Security plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to and including 19.1.13. This vulnerability was discovered and reported by Wordfence, with the CVE identifier CVE-2024-4344 being assigned on June 2, 2024 (NVD).

The vulnerability stems from missing or incorrect nonce validation on the exec function within the plugin. The CVSS v3.1 base score is 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, indicating that the vulnerability requires user interaction but can be exploited remotely without authentication (NVD).

When successfully exploited, this vulnerability allows unauthenticated attackers to disable pin protection for the admin interface of the plugin. This can be achieved through a forged request, provided the attacker can trick a site administrator into performing a specific action, such as clicking on a malicious link (NVD).

The vulnerability requires user interaction for successful exploitation. An attacker needs to craft a malicious request and convince a site administrator to interact with it, typically through social engineering tactics (NVD).

Users of the Shield Security plugin should update to a version newer than 19.1.13 to address this vulnerability. The fix involves proper implementation of nonce validation for the exec function (NVD).