CVE-2026-114444: Security by CleanTalk < 2.191 - Admin+ Sensitive Data Disclosure via FSWatcher File Viewer

Q: Which WordPress sites are exposed?

Sites using a version of the plugin before 2.191 are affected. The issue is especially relevant to WordPress multisite deployments because a subsite administrator who is not a Super Admin can access the vulnerable viewer.

Q: What access does an attacker need?

An attacker needs administrator-level access that is not necessarily Super Admin access. Exploitation does not require user interaction, but the attack complexity is rated high.

Q: What information could be disclosed?

The file viewer can expose sensitive tracked files, including the main WordPress configuration file. On a standard installation, this can disclose authentication keys, salts, and database credentials.

Q: Is the default configuration affected?

A standard WordPress installation may expose database credentials through its main configuration file if it is accessible through the vulnerable File System Watcher viewer.

Q: What should be done if sensitive files may already have been viewed?

Update the plugin to version 2.191 or later. If the main configuration file may have been disclosed, treat the exposed authentication keys, salts, and database credentials as compromised and rotate them.

Published Oct 30, 2026

Updated

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its File System Watcher file viewer to Super Admins or to the files it legitimately tracks, allowing a non-super-admin administrator, including a subsite administrator on WordPress multisite, to read the contents of sensitive tracked files such as the main configuration file and disclose the site's authentication keys, salts and, on a standard install, database credentials.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Security by CleanTalk to a version that resolves this vulnerability.
Fixed in 2.191

Event History

Oct 30, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:16 AM

Description

Data Sourced

via NVD·06:16 AM

SeverityWeakness

Frequently Asked Questions

Which WordPress sites are exposed?

Sites using a version of the plugin before 2.191 are affected. The issue is especially relevant to WordPress multisite deployments because a subsite administrator who is not a Super Admin can access the vulnerable viewer.

What access does an attacker need?

An attacker needs administrator-level access that is not necessarily Super Admin access. Exploitation does not require user interaction, but the attack complexity is rated high.

What information could be disclosed?

The file viewer can expose sensitive tracked files, including the main WordPress configuration file. On a standard installation, this can disclose authentication keys, salts, and database credentials.

Is the default configuration affected?

A standard WordPress installation may expose database credentials through its main configuration file if it is accessible through the vulnerable File System Watcher viewer.

What should be done if sensitive files may already have been viewed?

Update the plugin to version 2.191 or later. If the main configuration file may have been disclosed, treat the exposed authentication keys, salts, and database credentials as compromised and rotate them.

CVE-2026-114444: Security by CleanTalk < 2.191 - Admin+ Sensitive Data Disclosure via FSWatcher File Viewer

Remediation

Event History

Frequently Asked Questions

Which WordPress sites are exposed?

What access does an attacker need?

What information could be disclosed?

Is the default configuration affected?

What should be done if sensitive files may already have been viewed?

Company

Resources

Contact

Frequently Asked Questions

Which WordPress sites are exposed?

What access does an attacker need?

What information could be disclosed?

Is the default configuration affected?

What should be done if sensitive files may already have been viewed?