CVE-2026-114444
Received Received - Intake

Security Plugin File System Watcher Information Disclosure

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: WPScan

Description
The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its File System Watcher file viewer to Super Admins or to the files it legitimately tracks, allowing a non-super-admin administrator, including a subsite administrator on WordPress multisite, to read the contents of sensitive tracked files such as the main configuration file and disclose the site's authentication keys, salts and, on a standard install, database credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-114444
EUVD
EUVD-2026-113724

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Security Plugin, Firewall & Malware Scanner with Auto Removal 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Security Plugin, Firewall & Malware Scanner with Auto Removal for WordPress. It allows non-super-admin administrators, including subsite administrators in multisite setups, to read sensitive files tracked by the plugin's File System Watcher. This includes configuration files that may contain authentication keys, salts, and database credentials.

Detection Guidance

Check the installed version of the Security Plugin, Firewall & Malware Scanner with Auto Removal. If it is below 2.191, the system is vulnerable. Use WordPress admin panel or run: wp plugin list --name='security by cleantalk' to verify the version.

Impact Analysis

An attacker with admin access could exploit this to read sensitive files like the main configuration file. This may lead to disclosure of site authentication keys, salts, and database credentials, potentially allowing further compromise of the WordPress site or database.

Mitigation Strategies

Update the Security Plugin, Firewall & Malware Scanner with Auto Removal to version 2.191 or later immediately. Remove non-essential administrator accounts and restrict file viewer access to Super Admins only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-114444. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart