Authentication Bypass in Firewall & Malware Scanner Plugin by WordPress
CVE-2026-114443
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 30 October 2026
Badges
What is CVE-2026-114443?
The Security Plugin, Firewall & Malware Scanner for WordPress prior to version 2.191 presents a significant security issue wherein the authentication mechanism fails to verify a user's password before validating a two-factor authentication code. As a result, an attacker possessing the current authenticator code can gain unauthorized access to any account, including administrative accounts, without requiring the user's password. This poses a critical risk to the security and integrity of the affected WordPress sites.
Affected Version(s)
Security Plugin, Firewall & Malware Scanner with Auto Removal 0 < 2.191
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.