CVE-2026-114444 in Security Plugin
Summary
by MITRE • 10/30/2026
The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its File System Watcher file viewer to Super Admins or to the files it legitimately tracks, allowing a non-super-admin administrator, including a subsite administrator on WordPress multisite, to read the contents of sensitive tracked files such as the main configuration file and disclose the site's authentication keys, salts and, on a standard install, database credentials.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in versions of the Security Plugin, Firewall & Malware Scanner with Auto Removal prior to version 2.191 represents a critical authorization bypass within the WordPress ecosystem. This flaw specifically affects the File System Watcher component, which is designed to monitor changes to specific files for security purposes. The core technical deficiency lies in an insufficient access control mechanism that fails to enforce role-based restrictions on who can view the contents of these monitored files. While the plugin correctly restricts certain administrative functions to Super Admins or users with elevated privileges, it erroneously grants read access to the File System Watcher interface for any user holding a standard administrator role. This oversight is particularly severe in WordPress multisite environments, where subsite administrators are granted limited scope over their specific sites but retain full administrative capabilities within that context. Consequently, these lower-privilege users can exploit this misconfiguration to bypass intended security boundaries and access sensitive system files that should remain opaque to them.
From a technical perspective, the vulnerability allows for unauthorized information disclosure through the manipulation of file paths or by simply accessing the File System Watcher interface without proper privilege verification. The plugin tracks critical configuration files such as wp-config.php, which serves as the central hub for WordPress database connections and security settings. By reading this file, an attacker with administrator privileges can extract authentication keys and salts used to secure user sessions and cookies. Furthermore, in standard installations where best practices are not strictly followed or default configurations persist, the database credentials including hostnames, usernames, and passwords may be exposed within these configuration files. This exposure transforms a simple information leak into a potential gateway for deeper system compromise, as access to database credentials often allows an attacker to directly interact with the backend data store, potentially leading to full site takeover if combined with other vectors or weak password policies.
The operational impact of this vulnerability is significant due to its low barrier to entry and high reward. An authenticated administrator does not need complex exploitation techniques; they merely need access to the plugin's interface. In a multisite network, a subsite administrator can compromise the integrity of that specific site by stealing credentials or disrupting service through knowledge of internal configurations. The disclosure of authentication salts weakens the security of all user sessions on the platform, potentially allowing for session hijacking attacks if an attacker also captures cookies. Additionally, exposure of database credentials enables direct SQL injection opportunities or unauthorized data exfiltration from the underlying MySQL or MariaDB instance. This undermines the principle of least privilege and erodes trust in the plugin's ability to protect sensitive infrastructure components despite its name suggesting robust security features.
To mitigate this risk, immediate action is required by updating the Security Plugin, Firewall & Malware Scanner with Auto Removal to version 2.191 or later where these access controls have been corrected. Administrators should verify that only Super Admins retain access to sensitive file viewing capabilities within the plugin settings. In environments running WordPress multisite, it is crucial to audit user roles and ensure that subsite administrators do not possess unnecessary privileges related to core configuration files. Regular security audits and monitoring of administrative activity logs can help detect any unauthorized attempts to view these restricted resources before an attacker successfully exploits them. Adhering to industry standards such as CWE-269 Improper Privilege Management is essential for preventing similar authorization flaws in future plugin development or custom code implementations. Furthermore, aligning with MITRE ATT&CK techniques related to Credential Access and Discovery helps organizations understand the broader threat landscape associated with this type of vulnerability and implement compensating controls like multi-factor authentication and strict role-based access control policies across all administrative interfaces.