CVE-2025-11705
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
The Anti-Malware Security and Brute-Force Firewall plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to and including 4.23.81 due to a missing capability check combined with information exposure in several GOTMLS_* AJAX actions. An authenticated attacker with Subscriber-level access and above can read arbitrary files on the server.
Risk Assessment
A low-privileged attacker could read sensitive files (e.g., configuration, credentials), potentially leading to further security compromise.
Recommendation
Update the plugin to a version later than 4.23.81 if available, or temporarily disable the plugin and verify AJAX action permissions.
Other vulnerabilities in Anti-Malware Security and Brute-Force Firewall
See all- CVE-2026-57691Medium
The Anti-Malware Security and Brute-Force Firewall (gotmls) plugin contains a reflected XSS vulnerability due to improper input neutralization during page generation. The issue affects versions up to and including 4.23.89.
- CVE-2026-39478High
Versions of Anti-Malware Security and Brute-Force Firewall up to 4.23.87 are vulnerable to PHP Object Injection by attackers.
Original NVD description (English source)
The Anti-Malware Security and Brute-Force Firewall plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 4.23.81 due to a missing capability check combined with an information exposure in several GOTMLS_* AJAX actions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS