{"id":"CVE-2026-114443","kind":"vulnerability","aliases":["CVE-2026-114443"],"related":[],"title":"WordPress security plugin skips password check at two-factor login","description":"The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not verify the account password before accepting an authenticator-app two-factor code at login, allowing anyone who holds a user's current authenticator code to log in as that user, including an administrator, without the password.","summary":"The Security Plugin, Firewall & Malware Scanner WordPress plugin before 2.191 does not verify the account password when an authenticator-app two-factor code is submitted at login. An attacker who holds a user's current authenticator code can sign in as that user, including an administrator, without the password.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress"],"not_affected_if":["plugin-version-2.191-or-later","two-factor-not-enabled"],"how_to_check":"- Check the installed version of the Security Plugin, Firewall & Malware Scanner with Auto Removal plugin in the WordPress admin plugins list; versions before `2.191` are affected.\n- Confirm whether two-factor login through the plugin is enabled for user accounts.","fix":null,"status":"open","published_at":"2026-10-30T06:16:45+00:00","first_seen_at":"2026-10-30T06:28:39+00:00","triaged_at":"2026-10-30T06:30:05+00:00","updated_at":"2026-10-30T06:30:05+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T06:30:05Z","model":"claude-haiku-5-5","output":{"fix":"- Move the Security Plugin, Firewall & Malware Scanner with Auto Removal plugin to `2.191` or later.","reach":"internet","title":"WordPress security plugin skips password check at two-factor login","impact":"high","summary":"The Security Plugin, Firewall & Malware Scanner WordPress plugin before 2.191 does not verify the account password when an authenticator-app two-factor code is submitted at login. An attacker who holds a user's current authenticator code can sign in as that user, including an administrator, without the password.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"attacker logs in as administrator without password","analyst_note":"","how_to_check":"- Check the installed version of the Security Plugin, Firewall & Malware Scanner with Auto Removal plugin in the WordPress admin plugins list; versions before `2.191` are affected.\n- Confirm whether two-factor login through the plugin is enabled for user accounts.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-version-2.191-or-later","two-factor-not-enabled"],"who_is_affected":"Sites running the Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 with authenticator-app two-factor login in use. The flaw requires holding a user's current authenticator code, so sites without two-factor login through the plugin are less exposed. unknown whether sources list other conditions.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000704,"input_tokens":4127,"output_tokens":583,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-114443':14A,17A '-2026':13A,16A '2.191':32B,86C 'accept':94C 'account':37B,91C 'administr':70B,123C 'allow':105C 'anyon':106C 'app':43B,98C 'attack':53B 'authent':42B,60B,97C,113C 'authenticator-app':41B,96C 'auto':81C 'check':6A 'code':47B,61B,102C,114C 'current':59B,112C 'cve':12A,15A 'factor':10A,46B,101C 'firewal':26B,77C 'hold':55B,108C 'host':21B 'includ':68B,121C 'log':116C 'login':11A,51B,104C 'malwar':27B,78C 'packag':18B 'password':5A,38B,73B,92C,126C 'plugin':3A,25B,30B,76C,84C 'remov':82C 'scanner':28B,79C 'secur':2A,24B,75C 'self':20B 'self-host':19B 'sign':63B 'skip':4A 'submit':49B 'two':9A,45B,100C 'two-factor':8A,44B,99C 'user':57B,67B,110C,120C 'verifi':35B,89C 'without':71B,124C 'wordpress':1A,22B,29B,83C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 with authenticator-app two-factor login in use. The flaw requires holding a user's current authenticator code, so sites without two-factor login through the plugin are less exposed. unknown whether sources list other conditions.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T06:16:45+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114443","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114443","severity":null,"published_at":"2026-10-30T06:16:45+00:00","modified_at":"2026-10-30T06:16:45+00:00","first_seen_at":"2026-10-30T06:28:39+00:00","fetched_at":"2026-10-30T06:28:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}