Vulnerability · Published Oct 30, 2026 · Assigned by WPScan

CVE-2026-114444Security by CleanTalk < 2.191 - Admin+ Sensitive Data Disclosure via FSWatcher File Viewer

Medium 4.4

In plain English

A medium-severity information exposure in Security Plugin, Firewall & Malware Scanner with Auto Removal from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 3.1)4.4Medium

Exploit odds (30 days)0.2%top 86.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its File System Watcher file viewer to Super Admins or to the files it legitimately tracks, allowing a non-super-admin administrator, including a subsite administrator on WordPress multisite, to read the contents of sensitive tracked files such as the main configuration file and disclose the site's authentication keys, salts and, on a standard install, database credentials.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Security Plugin, Firewall & Malware Scanner with Auto Removal	0 – before 2.191

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

References

https://wpscan.com/vulnerability/4f3e845e-2f30-4ea2-9a42-4adf01840d94/ exploit, vdb-entry, technical-description