CVE-2025-11705 | BDVDB-2026-299945 Detail

Description#

The Anti-Malware Security and Brute-Force Firewall plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 4.23.81 due to a missing capability check combined with an information exposure in several GOTMLS_* AJAX actions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12025-10-29Record published in the CVE List.
2. Version 22026-04-08Most recent update recorded in the CVE List.