TI-2026-82939 Aliases CVE-2026-114444 GHSA-g4xh-fpq4-34j5

Sensitive data disclosure in Security by CleanTalk file viewer

LOW 20CWE-200Published 2026-10-30 · Updated 2026-10-30

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: High
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-200.

Summary

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not limit its File System Watcher file viewer to Super Admins or tracked files (CWE-200). An administrator who is not a super admin, including a subsite administrator on WordPress multisite, can read tracked files such as the main configuration file. This exposes authentication keys, salts and, on a standard install, database credentials. An exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its File System Watcher file viewer to Super Admins or to the files it legitimately tracks, allowing a non-super-admin administrator, including a subsite administrator on WordPress multisite, to read the contents of sensitive tracked files such as the main configuration file and disclose the site's authentication keys, salts and, on a standard install, database credentials.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00227 13th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix Fixed Security Plugin, Firewall & Malware Scanner with Auto Removal (Unknown): 2.191

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Unknown	Security Plugin, Firewall & Malware Scanner with Auto Removal	before 2.191	2.191	Patch available	CNA

Security Plugin, Firewall & Malware Scanner with Auto Removal VendorUnknown Affected before 2.191 Fixed in 2.191 Patch available CNA

Remediation

Update the Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin to version 2.191, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Fix · CNA Security Plugin, Firewall & Malware Scanner with Auto Removal (Unknown) Fixed in 2.191

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-10-30
Security Plugin, Firewall & Malware Scanner with Auto Removal 2.191
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-82938 Authentication bypass in WordPress Security plugin via 2FA codePriority LOW 34
Show all 2 records →

Timeline

2026-10-30 Threatist record created from CVE-2026-114444
2026-10-30 Alias added: GHSA-g4xh-fpq4-34j5
2026-10-30 CVSS score added · CISA ADP
2026-10-30 Weakness changed · CISA ADP
2026-10-30 CISA SSVC decision points changed

References

Exploit 1

https://wpscan.com/vulnerability/4f3e845e-2f30-4ea2-9a42-4adf01840d94/

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences