Anti-Malware Security and Brute-Force Firewall vulnerabilities

The Anti-Malware Security and Brute-Force Firewall (gotmls) plugin contains a reflected XSS vulnerability due to improper input neutralization during page generation. The issue affects versions up to and including 4.23.89.

Versions of Anti-Malware Security and Brute-Force Firewall up to 4.23.87 are vulnerable to PHP Object Injection by attackers.

The Anti-Malware Security and Brute-Force Firewall plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to and including 4.23.81 due to a missing capability check combined with information exposure in several GOTMLS_* AJAX actions. An authenticated attacker with Subscriber-level access and above can read arbitrary files on the server.