Threat Entry Updated 2026-02-19

CVE-2025-14427 - And Prevents Security Breaches Plugin

The Shield Security: Blocks Bots, Protects Users, and Prevents Security Breaches plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `MfaEmailDisable` action in all versions up to, and including, 21.0.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to disable the global Email 2FA setting for the entire site.

PLUGIN And Prevents Security Breaches

CVE-2025-14427

MEDIUM CVSS 4.3 2026-02-19

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-01-16

CVE-2025-15370 - And Prevents Security Breaches Plugin

The Shield: Blocks Bots, Protects Users, and Prevents Security Breaches plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 21.0.9 via the MfaGoogleAuthToggle class due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to disable Google Authenticator for any user.

PLUGIN And Prevents Security Breaches

CVE-2025-15370

MEDIUM CVSS 4.3 2026-01-16

Risk Score

Open Full Technical Breakdown