{"id":"CVE-2026-114444","title":"Security by CleanTalk < 2.191 - Admin+ Sensitive Data Disclosure via FSWatcher File Viewer","summary":"The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its File System Watcher file viewer to Super Admins or to the files it legitimately tracks, allowing a non-super-admin admi…","severity":"medium","cvss":4.4,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","cvssSource":"adp","cwe":["CWE-200"],"product":"Security Plugin, Firewall & Malware Scanner with Auto Removal","affected":["security_plugin_firewall_malware_scanner_with_auto_removal < 2.191"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-30T13:18:30.706278Z"},"published":"2026-10-30","updated":"2026-10-30","sourceUpdated":"2026-10-30T13:26:47.723Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-114444","references":[{"url":"https://wpscan.com/vulnerability/4f3e845e-2f30-4ea2-9a42-4adf01840d94/"}],"tags":["cve.org"],"epss":0.00227,"epssPercentile":0.13467,"ingestedAt":"2026-11-05T16:07:30.266Z","slug":"CVE-2026-114444","body":"## Overview\n\nThe Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its File System Watcher file viewer to Super Admins or to the files it legitimately tracks, allowing a non-super-admin administrator, including a subsite administrator on WordPress multisite, to read the contents of sensitive tracked files such as the main configuration file and disclose the site's authentication keys, salts and, on a standard install, database credentials.\n\n## Affected\n\n- `security_plugin_firewall_malware_scanner_with_auto_removal < 2.191`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":24.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}