CVE-2026-114443 Details
Description
The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not verify the account password before accepting an authenticator-app two-factor code at login, allowing anyone who holds a user's current authenticator code to log in as that user, including an administrator, without the password.
A vulnerability exists in the Security Plugin, Firewall & Malware Scanner with Auto Removal for WordPress, affecting versions prior to 2.191. The issue arises because the plugin does not require users to enter their account password before accepting a two-factor authentication code from an authenticator app during login. This flaw allows anyone with access to a user's authenticator code to log in as that user, including administrators, without needing the password.
Users are advised to update the Security Plugin, Firewall & Malware Scanner with Auto Removal to version 2.191 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/8f4a0675-82f0-4bbc-a46b-b88fc3863219/ | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Security Plugin, Firewall & Malware Scanner with Auto Removal | < 2.191 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 30, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |