# CVE-2026-114444: Security by CleanTalk WordPress plugin sensitive data disclosure via File System Watcher

Source: https://junglewise.ai/threats/cve-2026-114444-the-security-plugin-firewall-malware-scanner-with-auto-removal  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-114444 · Severity: info · Published 2026-10-30

The Security by CleanTalk WordPress plugin contains a file viewer that improperly restricts access to sensitive tracked files. Non-super-admin administrators can read the plugin's tracked files including the WordPress configuration file, exposing database credentials and authentication keys that would otherwise require direct server access or database breaches to obtain.

Vendors: [CleanTalk](https://junglewise.ai/threats/vendors/cleantalk).

## Quick answers

**Is CVE-2026-114444 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114444 being exploited in the wild.

**How severe is CVE-2026-114444?** Informational severity, published 30 October 2026.

**Which products and versions are affected?** CleanTalk Security by CleanTalk before 2.191.

**Is there a fix for CVE-2026-114444?** Yes: fixed in 2.191. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-114444 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-114444?** Check whether you run CleanTalk Security by CleanTalk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.191

## Technical details

The File System Watcher feature in the plugin fails to enforce proper authorization checks, allowing lower-privileged admin users (including multisite subsite administrators) to view files the plugin tracks. An authenticated admin user can access the file viewer to read configuration files, extracting credentials. The vulnerability requires an existing administrator account and affects all installations before version 2.191.

## Affected products

- CleanTalk Security by CleanTalk before 2.191

## Timeline

- 2026-10-28: disclosed
- 2026-10-30: advisory

## References

- [https://wpscan.com/vulnerability/4f3e845e-2f30-4ea2-9a42-4adf01840d94/](https://wpscan.com/vulnerability/4f3e845e-2f30-4ea2-9a42-4adf01840d94/)

## Related threats

- [Security by CleanTalk authentication bypass via authenticator code](https://junglewise.ai/threats/cve-2026-114443-the-security-plugin-firewall-malware-scanner-with-auto-removal)