CVE-2026-114444 Details
Description
The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its File System Watcher file viewer to Super Admins or to the files it legitimately tracks, allowing a non-super-admin administrator, including a subsite administrator on WordPress multisite, to read the contents of sensitive tracked files such as the main configuration file and disclose the site's authentication keys, salts and, on a standard install, database credentials.
A vulnerability in the Security Plugin, Firewall & Malware Scanner with Auto Removal for WordPress, affects versions prior to 2.191. The issue arises because the plugin's File System Watcher file viewer is not restricted to Super Admins or to the files it should properly track. This flaw allows a non-super-admin administrator, including a subsite administrator on WordPress multisite, to access sensitive files that are being monitored. Exploiting this vulnerability could lead to the exposure of the main configuration file, revealing the site's authentication keys, salts, and, in a standard installation, database credentials.
Users are advised to update the WordPress Security Plugin, Firewall & Malware Scanner with Auto Removal to version 2.191 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/4f3e845e-2f30-4ea2-9a42-4adf01840d94/ | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Security Plugin, Firewall & Malware Scanner with Auto Removal | < 2.191 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 30, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |