Live › vulnerability › CVE-2026-114444
The Security Plugin, Firewall & Malware Scanner WordPress plugin before 2.191 lets a non-super-admin administrator, including a subsite administrator on multisite, open its File System Watcher file viewer. That viewer can read sensitive tracked files such as wp-config.php, exposing authentication keys, salts and, on a standard install, database credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 06:28 UTC. All times on this page are UTC.
Sites running the Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191, especially multisite networks where subsite administrators hold accounts. The exposure requires an administrator account that is not a super admin; sites with only trusted super admins are less exposed. Sites on a newer version can skip it.
No product ranges from the sources yet.
2.191 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its File System Watcher file viewer to Super Admins or to the files it legitimately tracks, allowing a non-super-admin administrator, including a subsite administrator on WordPress multisite, to read the contents of sensitive tracked files such as the main configuration file and disclose the site's authentication keys, salts and, on a standard install, database credentials.
This page as .md · .json · in your agent: get_signal("CVE-2026-114444")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.