CVE-2026-114443

— UNSCORED

Published 2026-10-30 · Updated 2026-10-30

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not verify the account password before accepting an authenticator-app two-factor code at login, allowing anyone who holds a user's current authenticator code to log in as that user, including an administrator, without the password.

All references

https://wpscan.com/vulnerability/8f4a0675-82f0-4bbc-a46b-b88fc3863219/

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.