CVE-2026-114443
High 7.5
Description
The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not verify the account password before accepting an authenticator-app two-factor code at login, allowing anyone who holds a user's current authenticator code to log in as that user, including an administrator, without the password.
Metrics
- CVSS 3.1
-
7.5 (HIGH)
Score source: CNA
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 0% (percentile: 9) as of 1 November 2026
- CWE
- CWE-287