CVE-2026-114443: Security by CleanTalk < 2.191 - Unauthenticated Authentication Bypass via Authenticator App Code

Q: Which accounts are at risk?

Any WordPress account that uses authenticator-app two-factor authentication through the affected plugin is at risk, including administrator accounts. An attacker who has the account's current authenticator-app code can log in without knowing the password.

Q: What does an attacker need to exploit this issue?

The attacker needs a valid current authenticator-app code for the target user. The issue is remotely reachable and does not require an existing WordPress account, but obtaining the code is necessary.

Q: Are installations running version 2.191 affected?

The issue is described as affecting plugin versions before 2.191. Update the plugin to version 2.191 or later.

Published Oct 30, 2026

Updated

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not verify the account password before accepting an authenticator-app two-factor code at login, allowing anyone who holds a user's current authenticator code to log in as that user, including an administrator, without the password.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Security by CleanTalk to a version that resolves this vulnerability.
Fixed in 2.191

Event History

Oct 30, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:16 AM

Description

Data Sourced

via NVD·06:16 AM

SeverityWeakness

Frequently Asked Questions

Which accounts are at risk?

Any WordPress account that uses authenticator-app two-factor authentication through the affected plugin is at risk, including administrator accounts. An attacker who has the account's current authenticator-app code can log in without knowing the password.

What does an attacker need to exploit this issue?

The attacker needs a valid current authenticator-app code for the target user. The issue is remotely reachable and does not require an existing WordPress account, but obtaining the code is necessary.

Are installations running version 2.191 affected?

The issue is described as affecting plugin versions before 2.191. Update the plugin to version 2.191 or later.

CVE-2026-114443: Security by CleanTalk < 2.191 - Unauthenticated Authentication Bypass via Authenticator App Code

Remediation

Event History

Frequently Asked Questions

Which accounts are at risk?

What does an attacker need to exploit this issue?

Are installations running version 2.191 affected?

Company

Resources

Contact

Frequently Asked Questions

Which accounts are at risk?

What does an attacker need to exploit this issue?

Are installations running version 2.191 affected?