Critical Security Alert: Arbitrary File Read Vulnerability in Anti-Malware Security and Brute-Force Firewall Plugin
A serious security vulnerability has been discovered in the popular Anti-Malware Security and Brute-Force Firewall WordPress plugin. This flaw could allow attackers too read any file on your server, perhaps exposing sensitive details. Understanding the risk and taking immediate action is crucial for protecting your website and your users.
What Happened?
Researchers at Wordfence identified a vulnerability (CVE-2025-11705) stemming from a missing capability check within the plugin’s GOTMLS_ajax_scan() function. This function handles AJAX requests, and a flaw in its security allowed attackers to bypass necessary permissions.
Specifically, an attacker could obtain a nonce - a security token – and use it to trigger the function. This allowed even low-privileged users to access files they shouldn’t be able to see.
Why is This a Problem for You?
This isn’t just a theoretical risk. Attackers gaining access to sensitive files can have devastating consequences:
* Database Credentials: The wp-config.php file, which stores your database name, username, and password, is a prime target.
* User Data: Compromised databases expose user emails, passwords (in hashed form), posts, and othre personal information.
* Authentication Keys: Attackers can steal keys and salts used for secure authentication, potentially gaining complete control of your site.
While the vulnerability isn’t considered critical due to the need for initial authentication, many websites inadvertently create the conditions for exploitation. If your site allows user subscriptions, memberships, or even simple commenting with accounts, you could be at risk.
What has Been Done?
The plugin developer, Eli, was notified of the issue by Wordfence and researcher Dmitrii Ignatyev on October 14th. Fortunately, a fix was released quickly.
Version 4.23.83, released on October 15th, addresses the vulnerability by implementing a proper user capability check using a new GOTMLS_kill_invalid_user() function. This ensures only authorized users can access sensitive data.
What Do You Need to Do Now?
Update Immediately. This is the most critically important step.Roughly 50,000 websites are still running vulnerable versions of the plugin, according to WordPress.org statistics.
Here’s how to update:
- Log in to your WordPress dashboard.
- Navigate to “Plugins” > “Installed Plugins.”
- If an update is available for “Anti-Malware security and Brute-Force Firewall,” click “Update Now.”
Verify the Version. After updating, confirm you’re running version 4.23.83 or later. you can find this information on the “Plugins” page.
Monitor Your Site. While Wordfence hasn’t detected active exploitation, public disclosure of the vulnerability increases the risk. Keep a close eye on your website for any unusual activity.
Resources for Further Information
* Wordfence Report: http://www.wordfence.com/blog/2025/10/100000-wordpress-sites-affected-by-arbitrary-file-read-vulnerability-in-anti-malware-security-and-brute-force-firewall-wordpress-plugin/
* Plugin Information: https://wordpress.org/plugins/gotmls/advanced/
Don’t delay. Protecting your website and your users’ data is paramount. Updating your plugin is a simple step that can prevent a potentially serious security breach.