---
id: CVE-2026-114444
title: >-
  Security by CleanTalk < 2.191 - Admin+ Sensitive Data Disclosure via FSWatcher
  File Viewer
summary: >-
  The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress
  plugin before 2.191 does not restrict its File System Watcher file viewer to
  Super Admins or to the files it legitimately tracks, allowing a
  non-super-admin admi…
severity: medium
cvss: 4.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N'
cvssSource: adp
cwe:
  - CWE-200
product: 'Security Plugin, Firewall & Malware Scanner with Auto Removal'
affected:
  - security_plugin_firewall_malware_scanner_with_auto_removal < 2.191
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-30T13:18:30.706278Z'
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T13:26:47.723Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-114444'
references:
  - url: 'https://wpscan.com/vulnerability/4f3e845e-2f30-4ea2-9a42-4adf01840d94/'
tags:
  - cve.org
epss: 0.00227
epssPercentile: 0.13467
ingestedAt: '2026-11-05T16:07:30.266Z'
---

## Overview

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its File System Watcher file viewer to Super Admins or to the files it legitimately tracks, allowing a non-super-admin administrator, including a subsite administrator on WordPress multisite, to read the contents of sensitive tracked files such as the main configuration file and disclose the site's authentication keys, salts and, on a standard install, database credentials.

## Affected

- `security_plugin_firewall_malware_scanner_with_auto_removal < 2.191`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.