The Shield plugin for WordPress suffers from an authorization bypass vulnerability due to missing validation on a user-controlled key in the MfaGoogleAuthToggle class. This insecure direct object reference allows attackers with authenticated Subscriber-level access or above to disable Google Authenticator for other users, potentially weakening multi-factor authentication protections. The issue is present in all versions up to 21.0.9. The CVSS v3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction.

An attacker with at least Subscriber-level access can disable Google Authenticator for any user, reducing the effectiveness of multi-factor authentication and potentially facilitating unauthorized account access. There is no direct impact on confidentiality or availability reported, but integrity is impacted due to the ability to alter authentication settings of other users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Subscriber-level access to trusted users only and monitor for suspicious changes to multi-factor authentication settings. Avoid granting unnecessary privileges to reduce risk.