CVE-2026-0722 describes an SQL injection vulnerability in the Shield Security WordPress plugin caused by improper nonce verification bypass via a user-supplied parameter in the 'isNonceVerifyRequired' function. This allows unauthenticated attackers to exploit Cross-Site Request Forgery to execute SQL injection attacks by tricking an administrator into performing an action such as clicking a crafted link. The vulnerability affects all versions up to and including 21.0.8 and can lead to unauthorized disclosure of sensitive database information.

Successful exploitation can result in unauthorized disclosure of sensitive information from the database without requiring authentication. The vulnerability leverages CSRF to bypass nonce verification, increasing the risk of attack if an administrator is tricked into executing a malicious request. There is no indication of data modification or availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking on suspicious links and consider disabling or limiting the use of the Shield Security plugin. Monitoring vendor channels for updates is recommended.