CVE-2026-114444

MediumCVSS 4.4/10Last modified Oct 30, 2026

Description

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its File System Watcher file viewer to Super Admins or to the files it legitimately tracks, allowing a non-super-admin administrator, including a subsite administrator on WordPress multisite, to read the contents of sensitive tracked files such as the main configuration file and disclose the site's authentication keys, salts and, on a standard install, database credentials.

Metrics

CVSS 3.1 4.4/10CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
Unknown	Security Plugin, Firewall & Malware Scanner with Auto Removal	< 2.191

References

https://wpscan.com/vulnerability/4f3e845e-2f30-4ea2-9a42-4adf01840d94/

Timeline

Published: Oct 30, 2026
Last modified: Oct 30, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1144566.5Multiple Snowflake client drivers implementing the `authenticator=externalbrowser` single sign-on flow could have allowed an attacker to int CVE-2026-1144573.7A flaw was found in mod_qos. An unauthenticated remote attacker could cause a Denial of Service (DoS) by sending a specially crafted JSON re CVE-2026-1144585.9A flaw was found in mod_qos. An unauthenticated remote attacker can cause a Denial of Service (DoS) by maintaining numerous concurrent low-r CVE-2026-1144593.7A flaw was found in mod_qos. When inspecting HTTP response bodies, improper boundary checking can cause the module to read memory outside al CVE-2026-114465.3The Booktics – Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthorized modification of d CVE-2026-1144605.3A flaw was found in mod_qos. An off-by-one pointer calculation error occurs when merging request body parameters with an existing URL query,CVE-2026-1144626.0Improper link resolution before file access ('link following') vulnerability in Velneo vServer. This issue affects vServer: from 32.3 before CVE-2026-1144637.5The webhook platform gateway in Nous Research Hermes Agent versions builds the session chat_id as webhook:{route_name}:{delivery_id} and re-CVE-2026-1144649.3IBM Process Mining 2.0.0 through 2.2.1 could allow a remote attacker to obtain sensitive information due to improper access control.CVE-2026-1144664.4Arbitrary data can be read or written through git-fast-import(1) and git-fast-export(1) features not marked unsafe CVE-2026-1144673.3Out-of-bounds write possible in Git when git-merge(1) used on tag with more than two GPG signatures CVE-2026-1144694.4Out-of-bounds read can crash git-apply(1) when binary patch inflates to very large size