CVE-2026-114444

Security by CleanTalk < 2.191 - Admin+ Sensitive Data Disclosure via FSWatcher File Viewer

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its File System Watcher file viewer to Super Admins or to the files it legitimately tracks, allowing a non-super-admin administrator, including a subsite administrator on WordPress multisite, to read the contents of sensitive tracked files such as the main configuration file and disclose the site's authentication keys, salts and, on a standard install, database credentials.

Affected

Security Plugin, Firewall & Malware Scanner with Auto Removal

CVSS v3.1 CNA

4.4 MEDIUMCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

EPSS

0.17% chance of exploitation in the next 30 days, 6th percentile

Published

2026-10-30

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/4f3e845e-2f30-4ea2-9a42-4adf01840d94/find archive

CVE references

• https://wpscan.com/vulnerability/4f3e845e-2f30-4ea2-9a42-4adf01840d94REFERENCE

References

• CVE Record
• NVD entry