security-plugin-firewall-malware-scanner-with-auto-removal
security-plugin-firewall-malware-scanner-with-auto-removal is a WordPress plugin with 2 published CVE records in this archive. The latest tracked vulnerability was published Oct 30, 2026; an upstream CVSS base score is still pending.
security-plugin-firewall-malware-scanner-with-auto-removalThis measures remediation-data coverage in this archive. It is not a claim that the plugin is vulnerability-free or insecure.
CVE-2026-114444: Security Plugin, Firewall & Malware Scanner with Auto Removal: Sensitive file disclosure
The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its File System Watcher file viewer to Super Admins or to the files it legitimately tracks, allowing a non-super-admin administrator, including a subsite administrator on WordPress multisite, to read the contents of sensitive tracked files such as the main configuration file and disclose the site's authentication keys, salts and, on a standard install, database credentials. The structured affected range is < 2.191.
| Safe version |
|
||
|---|---|---|---|
| Oct 30, 2026 |
CVE-2026-114444
Security Plugin, Firewall & Malware Scanner with Auto Removal: Sensitive file disclosure
The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its File System Watcher file viewer to Super Admins or to the files it legitimately tracks, allowing a non-super-admin administrator, including a subsite administrator on WordPress multisite, to read the contents of sensitive tracked files such as the main configuration file and disclose the site's authentication keys, salts and, on a standard install, database credentials. The structured affected range is < 2.191.
|
2.191 |
CVEPending
|
| Oct 30, 2026 |
CVE-2026-114443
Security Plugin, Firewall & Malware Scanner with Auto Removal: Password verification bypass
The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not verify the account password before accepting an authenticator-app two-factor code at login, allowing anyone who holds a user's current authenticator code to log in as that user, including an administrator, without the password. The structured affected range is < 2.191.
|
2.191 |
CVEPending
|