Vulnerabilities and security researches formalcare-security malcare-security

Sep 04, 2026

CVE, Research URL: CVE-2026-84776
Home page URL: Security reports for MalCare WordPress Security Plugin – Malware Scanner, Cleaner, Security Firewall
Application: MalCare WordPress Security Plugin – Malware Scanner, Cleaner, Security Firewall
Date: Sep 03, 2026
Research Description: Unauthenticated Denial of Service Attack in MalCare Security <= 6.69 versions.
Affected versions: max 6.72.
Status: vulnerable

Aug 27, 2026

CVE, Research URL: CVE-2026-19718
Home page URL: Security reports for MalCare WordPress Security Plugin – Malware Scanner, Cleaner, Security Firewall
Application: MalCare WordPress Security Plugin – Malware Scanner, Cleaner, Security Firewall
Date: Aug 26, 2026
Research Description: The BlogVault Backup & Staging WordPress plugin before 6.65, MalCare WordPress Security Plugin WordPress plugin before 6.65, The WP Remote WordPress Plugin WordPress plugin before 6.65 do not prevent unauthenticated users from obtaining data derived from the secret that binds a site to its remote management service, and generate that secret with a weak pseudo-random number generator, allowing attackers to recover it and gain administrative access to the site.
Affected versions: max 6.65.
Status: vulnerable

Mar 27, 2026

PSC, Research URL: PSC-2026-64632
Home page URL: Security reports for MalCare WordPress Security Plugin – Malware Scanner, Cleaner, Security Firewall
Application: MalCare WordPress Security Plugin – Malware Scanner, Cleaner, Security Firewall
Date: Mar 27, 2026
Research Description: Security plugins are uniquely sensitive in WordPress because they operate with high privilege, touch authentication and request filtering, and often integrate with external scanning and firewall services. If access control, request integrity, or output handling is weak, attackers may force configuration changes via CSRF, abuse endpoints to leak site security metadata, or inject malicious content into admin-facing reports. MalCare WordPress Security Plugin – Malware Scanner, Cleaner, Security Firewall version 6.39 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64632, confirming that the plugin was reviewed from a secure code perspective with attention to the most common exploitation paths for WordPress security and monitoring plugins.
Affected versions: Min 6.76, max 6.76.
Status: SAFE & CERTIFIED

Jun 07, 2024

CVE, Research URL: fd2a15caa8a8f2727f6a5c0569ecbd735696d652
Home page URL: Security reports for MalCare WordPress Security Plugin – Malware Scanner, Cleaner, Security Firewall
Application: MalCare WordPress Security Plugin – Malware Scanner, Cleaner, Security Firewall
Date: May 05, 2021
Research Description: MalCare WordPress Security Plugin – Malware Scanner, Cleaner, Security Firewall [malcare-security] < 4.58 WordPress MalCare Security plugin <= 4.57 - Authenticated Cross-Site Scripting (XSS) vulnerability Authenticated Cross-Site Scripting (XSS) vulnerability discovered by Lenon Leite in WordPress MalCare Security plugin (versions <= 4.57).
Affected versions: max 4.58.
Status: vulnerable