Security Plugin CVE-2026-114444

Requires an authenticated administrator who is NOT a Super Admin (PR:H) - the exact scenario called out is a subsite administrator on a WordPress multisite install, where the privilege boundary between subsite admins and Super Admins is what the flaw crosses. The attacker must reach the plugin's 'File System Watcher' file viewer feature, which is missing an authorization check restricting it to Super Admins and a scoping check limiting it to only the files the watcher legitimately tracks; the concrete target is the main configuration file (wp-config.php), whose disclosure yields authentication keys, salts and, on a standard install, database credentials. Limiting factors that reduce realistic risk: valid administrator-level credentials are needed (no unauthenticated path), the meaningful privilege escalation is primarily relevant on multisite deployments that have non-super-admin administrators, there is only confidentiality impact (no write/modify), and upgrading to version 2.191 remediates it.

All signals point to a genuinely modest priority rather than an urgent threat. The CVSS 3.1 vector (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N, base 4.4 Medium) requires high privileges (PR:H) - an already-authenticated administrator - so this is not a remote unauthenticated flaw; it is a privilege-boundary / trust-boundary weakness most meaningful on WordPress multisite, where a subsite administrator who is not a Super Admin can read network-level secrets they should not reach. EPSS is low at 0.17% (6th percentile), and the SSVC decision framework reports Exploitation: none, Automatable: no, Technical Impact: partial, all consistent with a low-urgency issue; KEV status is not listed (no active exploitation), and no public exploit is indicated in the input. The vuln.today decision label is 'this_month', i.e. schedule the patch in the normal cycle rather than treat as an emergency. The one signal that raises the stakes is impact: successful exploitation discloses wp-config.php contents - authentication keys, salts and, on a standard install, database credentials - which can enable full compromise, so C:H is justified. Net assessment: a real but contained risk gated behind administrator authentication, worth patching this cycle but not an emergency; the chief nuance to verify with the vendor is whether, on multisite, a subsite admin reading network-wide secrets should be modeled as a scope change (S:C), which the published S:U vector does not reflect.

A non-super-admin administrator - for example a subsite administrator on a WordPress multisite network - opens the plugin's File System Watcher file viewer, which fails to restrict access to Super Admins or to only the files it legitimately tracks, and requests the main configuration file. The viewer returns wp-config.php, exposing the site's authentication keys, salts and (on a standard install) database credentials. No public exploit was identified at time of analysis; exploitation requires an existing administrator account.