Anti-Malware Security and Brute-Force Firewall, CVE-2025-11705

CVE, Research URL: CVE-2025-11705
Home page URL: Security reports for Anti-Malware Security and Brute-Force Firewall
Application: Anti-Malware Security and Brute-Force Firewall
Published on: Oct 29, 2025
Research Description: The Anti-Malware Security and Brute-Force Firewall plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 4.23.81 due to a missing capability check combined with an information exposure in several GOTMLS_* AJAX actions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Affected versions: max 4.23.83.
Status: vulnerable