Security & Malware scan by CleanTalk <= 2.190 - Authenticated (Administrator+) Missing Authorization to Network-Wide File Actions, File Viewing and Salt Rewriting on Multisite
- ID
- WPSEC-2026-1817
- Plugin
- Security Plugin, Firewall & Malware Scanner with Auto Removal (security-malware-firewall)
- Affected
- all versions before 2.191
- Remediation
- Update to 2.191 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-28
- Attack surface
- Security & Malware scan by CleanTalk on WPSec AttackSurface
- Fix released
- Published
Description
The Security Plugin, Firewall & Malware Scanner with Auto Removal plugin for WordPress is vulnerable to Missing Authorization via several AJAX actions in all versions up to, and including, 2.190, due to the scanner file actions (restore from backup, cure, delete, view, quarantine, restore from quarantine and replace with original, plus the matching list-table bulk actions and OS cron / DB trigger actions), the File System Watcher compare, snapshot and file view actions, and the salt shuffling action checking only for the manage_options capability instead of requiring a Super Admin on multisite. This makes it possible for authenticated attackers with subsite administrator access on a multisite network to view (including wp-config.php through the File System Watcher view), modify or delete files shared by the whole network and rewrite the wp-config.php salts.
References
- https://wpsec.com/vuln/WPSEC-2026-1817/
- https://plugins.svn.wordpress.org/security-malware-firewall/tags/2.191/
- https://wordpress.org/plugins/security-malware-firewall/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS