CVE-2023-6989 is a critical (CVSS 9.8) local file inclusion flaw in the Shield Security plugin for WordPress, versions up to and including 18.5.9. Unauthenticated attackers can include and run PHP files via render_action_template. Update beyond 18.5.9 now. No login is needed.
What's affected
The record says all versions up to and including 18.5.9 are affected. No login is needed. The flaw sits in the render_action_template parameter.
The referenced WordPress.org changeset and Wordfence pages did not load for automated reading, so the fixed version is not named here. Any release above 18.5.9 is the starting point, and the changelog will confirm it.
How to check if you're exposed
Run these from your WordPress root with WP-CLI. They only read.
wp plugin list --fields=name,status,version,update
wp plugin get wp-simple-firewall --field=version
Versions up to and including 18.5.9 are affected. If WP-CLI is not available, open Plugins in the dashboard and read the version under the plugin name. Also check staging copies, old backups restored to test sites, and multisite networks, where the plugin may be installed on only some sites.
What to do now
- Update the plugin:
wp plugin update wp-simple-firewall, or use the Plugins screen. Confirm the version is above 18.5.9. - If no fixed release is available, deactivate and delete the plugin and use a maintained alternative.
- Review the site's user list and recent changes for anything you do not recognize, and rotate credentials the plugin handled.
- Keep automatic updates on for plugins that handle sensitive data, and remove plugins you no longer use.
- Check the web root and plugin folders for files you did not place there, and review access logs for odd requests to the plugin's actions.
Why it matters
The description says the render_action_template parameter lets a caller include PHP files on the server, which then execute. The record tags CWE-98 and CWE-22. A security plugin runs on every request and has deep access, so a flaw in it is a high-value target.
Path traversal happens when a program builds a file path from input and does not confirm the result stays inside the folder it meant to use. The fix is to normalize the path, compare it against an allowed base directory, and reject anything that leaves it. Never let request input choose which template or file is loaded. Map allowed names to fixed paths instead.
Patch priority depends on who can reach the flaw. Issues open to anonymous visitors come first, then issues that need a low-privilege account, then issues that need an administrator. Use the access level in the description to place this item in your queue, and write down the date you updated so you can answer later when someone asks whether a given site was exposed.
Weakness class in the record: CWE-98 (PHP Remote File Inclusion) CWE-22 (Path Traversal).
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Isn't a security plugin supposed to protect me?
It adds code and code has bugs. Keeping security plugins updated matters as much as any other plugin, and arguably more.
How do I find every site that runs this plugin?
Check your hosting dashboards and any site management tool, and run the WP-CLI commands above on each install. Agencies and hosts often forget staging copies and sites inherited from clients.
Sources
Last reviewed: 19 October 2026.
