CVE-2026-114443

HighCVSS 7.5/10Last modified Oct 30, 2026

Description

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not verify the account password before accepting an authenticator-app two-factor code at login, allowing anyone who holds a user's current authenticator code to log in as that user, including an administrator, without the password.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published: Oct 30, 2026
Last modified: Oct 30, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1144444.4The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its File System Watcher fi CVE-2026-1144566.5Multiple Snowflake client drivers implementing the `authenticator=externalbrowser` single sign-on flow could have allowed an attacker to int CVE-2026-1144573.7A flaw was found in mod_qos. An unauthenticated remote attacker could cause a Denial of Service (DoS) by sending a specially crafted JSON re CVE-2026-1144585.9A flaw was found in mod_qos. An unauthenticated remote attacker can cause a Denial of Service (DoS) by maintaining numerous concurrent low-r CVE-2026-1144593.7A flaw was found in mod_qos. When inspecting HTTP response bodies, improper boundary checking can cause the module to read memory outside al CVE-2026-114465.3The Booktics – Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthorized modification of d CVE-2026-1144605.3A flaw was found in mod_qos. An off-by-one pointer calculation error occurs when merging request body parameters with an existing URL query,CVE-2026-1144626.0Improper link resolution before file access ('link following') vulnerability in Velneo vServer. This issue affects vServer: from 32.3 before CVE-2026-1144637.5The webhook platform gateway in Nous Research Hermes Agent versions builds the session chat_id as webhook:{route_name}:{delivery_id} and re-CVE-2026-1144649.3IBM Process Mining 2.0.0 through 2.2.1 could allow a remote attacker to obtain sensitive information due to improper access control.CVE-2026-1144664.4Arbitrary data can be read or written through git-fast-import(1) and git-fast-export(1) features not marked unsafe CVE-2026-1144673.3Out-of-bounds write possible in Git when git-merge(1) used on tag with more than two GPG signatures