WordPress security changelog
UNKNOWN CVE-2026-114444 Received

Security Plugin, Firewall & Malware Scanner with Auto Removal: Sensitive file disclosure

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its File System Watcher file viewer to Super Admins or to the files it legitimately tracks, allowing a non-super-admin administrator, including a subsite administrator on WordPress multisite, to read the contents of sensitive tracked files such as the main configuration file and disclose the site's authentication keys, salts and, on a standard install, database credentials. The structured affected range is < 2.191.

CVE / CNA score Pending The CVE record has not published a CNA CVSS assessment.
NVD score Pending NVD has not published its own CVSS assessment.
Component
Security Plugin, Firewall & Malware Scanner with Auto Removal
Plugin slug
security-plugin-firewall-malware-scanner-with-auto-removal
Affected
< 2.191
Safe version
2.191
Published
Oct 30, 2026
Weakness
Not assigned

This CVE was published Oct 30, 2026 and is one of 2 known issues for this plugin.

What to do

Update, patch or deactivate.

Update to a supported release containing the confirmed fix: 2.191. Until that update is installed, restrict access to the affected functionality.

A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its File System Watcher file viewer to Super Admins or to the files it legitimately tracks, allowing a non-super-admin administrator, including a subsite administrator on WordPress multisite, to read the contents of sensitive tracked files such as the main configuration file and disclose the site's authentication keys, salts and, on a standard install, database credentials.

References

Primary and upstream sources