Live › vulnerability › CVE-2026-114443
The Security Plugin, Firewall & Malware Scanner WordPress plugin before 2.191 does not verify the account password when an authenticator-app two-factor code is submitted at login. An attacker who holds a user's current authenticator code can sign in as that user, including an administrator, without the password.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 06:28 UTC. All times on this page are UTC.
Sites running the Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 with authenticator-app two-factor login in use. The flaw requires holding a user's current authenticator code, so sites without two-factor login through the plugin are less exposed. unknown whether sources list other conditions.
No product ranges from the sources yet.
2.191 are affected.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not verify the account password before accepting an authenticator-app two-factor code at login, allowing anyone who holds a user's current authenticator code to log in as that user, including an administrator, without the password.
This page as .md · .json · in your agent: get_signal("CVE-2026-114443")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.