---
id: CVE-2026-114443
title: >-
  Security by CleanTalk < 2.191 - Unauthenticated Authentication Bypass via
  Authenticator App Code
summary: >-
  The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress
  plugin before 2.191 does not verify the account password before accepting an
  authenticator-app two-factor code at login, allowing anyone who holds a user's
  curre…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: adp
cwe:
  - CWE-287
product: 'Security Plugin, Firewall & Malware Scanner with Auto Removal'
affected:
  - security_plugin_firewall_malware_scanner_with_auto_removal < 2.191
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-30T13:18:48.388381Z'
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T13:26:47.867Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-114443'
references:
  - url: 'https://wpscan.com/vulnerability/8f4a0675-82f0-4bbc-a46b-b88fc3863219/'
tags:
  - cve.org
epss: 0.0019
epssPercentile: 0.08748
ingestedAt: '2026-11-05T16:07:30.268Z'
---

## Overview

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not verify the account password before accepting an authenticator-app two-factor code at login, allowing anyone who holds a user's current authenticator code to log in as that user, including an administrator, without the password.

## Affected

- `security_plugin_firewall_malware_scanner_with_auto_removal < 2.191`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.