BugShield research
Shufti 1.1.7 unauthenticated API credential and settings modification
Published 21 Oct 2026
Updated 21 Oct 2026
Does this affect my version?
Check your installed version against this advisory. This compares the report’s version ranges and does not scan your website.
BugShield advisory
highBugShield Scout discovered a missing authorisation check in Shufti | Identity Verification Service 1.1.7. A visitor without a WordPress account can replace the plugin's Shufti client ID and secret key and change identity verification settings. This permits unauthorised changes to the site's Shufti integration and can disrupt its verification workflow. The affected admin/partials/add-update.php script can be requested directly. It loads WordPress and processes settings writes without checking login status, user capabilities or a nonce. The credential writes target the literal wp_kyc_verification table, and verification settings use the payloadsetting table. Version 1.1.7 creates these tables with hardcoded names, so changing the WordPress table prefix does not by itself remove the affected tables or protect this handler. BugShield privately reported the issue through Shufti support on 19 October 2026. The developer confirmed that it reproduced the issue and released a fix in 1.1.8. Review of the published 1.1.8 package confirms removal of admin/partials/add-update.php. The replacement settings save handler is registered as an authenticated WordPress AJAX action and checks the manage_options capability and a valid nonce before saving. Credentials and settings now use the WordPress options API rather than writes to the hardcoded custom tables. The public 1.1.8 changelog describes these security changes. BugShield reviewed the affected and fixed source packages but has not performed an independent functional retest in WordPress. The confirmed affected version is 1.1.7; earlier versions were not assessed for this advisory. High is BugShield's qualitative severity assessment; no CVE or numerical CVSS score is assigned.
Discovered by BugShield Scout. Published by BugShield.
Shufti | Identity Verification Service
- Software
- plugin · shuftipro-kyc-identity-verification
- Affected versions
- From 1.1.7, through 1.1.7
- Fix availability
- Fix available
- Fixed versions
- 1.1.8
Recommended action
Back up your website and update Shufti to 1.1.8 or a later release. After updating, open the Shufti KYC settings and click Go Live to reactivate the verification button, as instructed in the developer's changelog. Confirm that the client ID, secret key and verification settings are correct, then test the intended verification workflow.
Need help fixing this issue?
Get help checking your site, applying an available update and resolving any problems after updating.
Get help with this issueQuestions about this vulnerability
Which versions of Shufti | Identity Verification Service are affected?
BugShield lists these affected versions: From 1.1.7, through 1.1.7. Use the version checker above to compare your installed release with this report.
Is a fix available for Shufti | Identity Verification Service?
BugShield reports a fix for this issue in Shufti | Identity Verification Service. It lists these fixed versions: 1.1.8. Back up your website and test the recommended update before applying it to your live site.
Where can I find my installed plugin version?
In WordPress, open Plugins > Installed Plugins and find the version shown beneath the plugin name.
Does an affected version mean my website has been hacked?
An affected version means the installed release matches a vulnerability described in this report. It does not show whether anyone has exploited it on your website. The checker compares version numbers with stored reports; it does not inspect your website.