CVE-2021-47977
HighSummary
The WordPress Plugin Anti-Malware Security and Bruteforce Firewall version 4.20.59 contains a directory traversal vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the file parameter.
Risk Assessment
Attackers can access sensitive system files, potentially leading to data exposure or further attacks on the system.
Recommendation
It is recommended to update the plugin to the latest version to mitigate this vulnerability and to monitor logs for potential attack attempts.
Original NVD description (English source)
WordPress Plugin Anti-Malware Security and Bruteforce Firewall 4.20.59 contains a directory traversal vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the file parameter. Attackers can send requests to the duplicator_download action via admin-ajax.php with path traversal sequences to access sensitive system files outside the intended directory.