Vulnerability · Published Oct 30, 2026 · Assigned by WPScan

CVE-2026-114443Security by CleanTalk < 2.191 - Unauthenticated Authentication Bypass via Authenticator App Code

High 7.5

In plain English

A high-severity improper authentication in Security Plugin, Firewall & Malware Scanner with Auto Removal from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.2%top 91.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not verify the account password before accepting an authenticator-app two-factor code at login, allowing anyone who holds a user's current authenticator code to log in as that user, including an administrator, without the password.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Security Plugin, Firewall & Malware Scanner with Auto Removal	0 – before 2.191

Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://wpscan.com/vulnerability/8f4a0675-82f0-4bbc-a46b-b88fc3863219/ exploit, vdb-entry, technical-description