CVE-2026-114443

HighCVSS 7.5

Published: 30/10/2026(UTC)Updated: 30/10/2026(UTC)Translated: 30/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

9th percentile - higher than 9% of all known CVEs

Summary

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not verify the account password before accepting an authenticator-app two-factor code at login. This allows anyone who holds a user's current authenticator code to log in as that user, including an administrator, without the password.

Risk Assessment

Anyone holding an intercepted or leaked 2FA code can log in as an administrator without a password, leading to full account and site compromise.

Recommendation

Update the plugin to version 2.191 or later. Consider resetting 2FA codes for administrative accounts after updating.

Other vulnerabilities in Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin

CVE-2026-114444Medium
The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its File System Watcher file viewer to Super Admins or to the files it legitimately tracks. This allows a non-super-admin administrator, including a subsite administrator on WordPress multisite, to read the contents of sensitive tracked files such as the main configuration file and disclose the site's authentication keys, salts and, on a standard install, database credentials.

Original NVD description (English source)

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not verify the account password before accepting an authenticator-app two-factor code at login, allowing anyone who holds a user's current authenticator code to log in as that user, including an administrator, without the password.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS