# Security & Malware scan by CleanTalk <= 2.190 - Authenticated (Administrator+) Missing Authorization to Network-Wide File Actions, File Viewing and Salt Rewriting on Multisite

- **ID:** WPSEC-2026-1817
- **Plugin:** Security Plugin, Firewall & Malware Scanner with Auto Removal (`security-malware-firewall`), https://wordpress.org/plugins/security-malware-firewall/
- **Affected versions:** all versions before 2.191
- **Fixed in:** 2.191 (Update to 2.191 or later.)
- **Severity:** Medium 6.6 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-28)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/security-malware-firewall
- **Fix released:** 2026-10-27
- **Published:** 2026-10-28
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1817/

## Description

The Security Plugin, Firewall & Malware Scanner with Auto Removal plugin for WordPress is vulnerable to Missing Authorization via several AJAX actions in all versions up to, and including, 2.190, due to the scanner file actions (restore from backup, cure, delete, view, quarantine, restore from quarantine and replace with original, plus the matching list-table bulk actions and OS cron / DB trigger actions), the File System Watcher compare, snapshot and file view actions, and the salt shuffling action checking only for the manage_options capability instead of requiring a Super Admin on multisite. This makes it possible for authenticated attackers with subsite administrator access on a multisite network to view (including wp-config.php through the File System Watcher view), modify or delete files shared by the whole network and rewrite the wp-config.php salts.

## References

- https://wpsec.com/vuln/WPSEC-2026-1817/
- https://plugins.svn.wordpress.org/security-malware-firewall/tags/2.191/
- https://wordpress.org/plugins/security-malware-firewall/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1817/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.