CVE-2026-114443 in Security Plugin, Firewall & Malware Scanner with Auto Removal Plugin
Summary
by MITRE • 10/30/2026
The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not verify the account password before accepting an authenticator-app two-factor code at login, allowing anyone who holds a user's current authenticator code to log in as that user, including an administrator, without the password.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in versions of the Security Plugin, Firewall & Malware Scanner with Auto Removal for WordPress prior to version 2.191 represents a critical authentication bypass flaw rooted in improper verification logic within the two-factor authentication implementation. The core technical deficiency lies in the sequence and validation checks performed during the login process when an authenticator-app code is provided. Specifically, the application fails to verify that the user has correctly entered their primary account password before accepting the time-based one-time password generated by a mobile authenticator application. This architectural oversight effectively decouples the two factors of authentication, reducing what should be a robust multi-factor security control into a single factor mechanism dependent solely on possession of the current dynamic code.
From an operational perspective, this flaw allows any individual who obtains or intercepts a user's current valid authenticator code to gain full access to that account without knowledge of the static password. In practical attack scenarios, this could be exploited through social engineering tactics where an attacker tricks a victim into revealing their six-digit code via phone call or messaging application. It also facilitates exploitation in environments where screen sharing is common or if an attacker has physical access to an unlocked device with the authenticator app open and visible. The severity of this issue is significantly amplified by its applicability to administrator accounts, which possess elevated privileges capable of modifying site settings, installing malicious plugins, altering user roles, and accessing sensitive database information.
This vulnerability aligns closely with CWE-287, which describes Improper Authentication, specifically the failure to verify all required authentication factors before granting access. It also maps to MITRE ATT&CK technique T1078, Valid Accounts, as it enables an attacker to authenticate using compromised credentials in a manner that bypasses intended security controls. The lack of password verification means that even if passwords are strong and complex, they offer no protection against this specific attack vector, rendering the multi-factor authentication feature ineffective for its primary purpose of adding a layer of defense beyond simple knowledge-based secrets.
To mitigate this risk, immediate action is required to update the plugin to version 2.191 or later, where the developers have addressed this logic error by enforcing strict sequential validation that requires both password and authenticator code verification before session creation. Administrators should also consider implementing additional layers of security such as IP-based access restrictions for login pages if possible within their hosting environment, and ensuring that all staff members are educated on not sharing authentication codes under any circumstances. Regular auditing of user activity logs can help detect unauthorized access attempts resulting from this vulnerability while the patch is being deployed across affected systems.