CVE-2025-14427 is a missing authorization vulnerability (CWE-862) in the Shield Security: Blocks Bots, Protects Users, and Prevents Security Breaches WordPress plugin. The issue arises because the plugin does not perform a capability check on the MfaEmailDisable action, allowing authenticated users with Subscriber-level privileges or higher to disable the global Email-based two-factor authentication (2FA) setting. This affects all plugin versions up to and including 21.0.9. The vulnerability impacts the integrity of the 2FA configuration but does not affect confidentiality or availability. No known exploits are reported, and no patch or remediation details are provided in the input data.

An authenticated attacker with at least Subscriber-level access can disable the global Email 2FA setting for the entire WordPress site, potentially reducing the security posture by weakening multi-factor authentication enforcement. This could facilitate further unauthorized actions by lowering the barrier for account compromise. The vulnerability does not directly impact confidentiality or availability but compromises the integrity of security settings.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, site administrators should consider restricting Subscriber-level user capabilities or monitoring changes to 2FA settings. No vendor advisory or patch information is provided in the current data, so no official fix can be confirmed at this time.