Vulnerability

CERT-In Vulnerability Note CIVN-2025-0339
Arbitrary File Read Vulnerability in Anti-Malware Security and Brute-Force Firewall WordPress Plugin

Original Issue Date:November 25, 2025

Severity Rating: MEDIUM

Software Affected

WordPress Plugin Anti-Malware Security and Brute-Force Firewall - versions 4.23.81 and earlier

Overview

A vulnerability has been reported in Anti-Malware Security and Brute-Force Firewall plugin for WordPress which could allow an authenticated attacker with subscriber-level or higher access privileges to disclose sensitive information from arbitrary files on the targeted system.

Target Audience:
Users of affected WordPress Plugins.

Risk Assessment:
Medium risk of remote sensitive information disclosure.

Impact Assessment:
Potential for unauthorized access, privilege escalation, and full compromise.

Description

Anti-Malware Security and Brute-Force Firewall is a WordPress plugin designed to help protect against malicious software infections and prevent brute-force attacks.

The vulnerability exists in the Anti-Malware Security and Brute-Force Firewall plugin for WordPress due to a missing capability checks and improper information handling in multiple GOTMLS_* AJAX actions.

Successful exploitation of these vulnerabilities could allow an authenticated attacker to disclose sensitive information from arbitrary files on the targeted system.

Solution

Apply the necessary patches and updates as provided by ISC:
https://www.wordfence.com/blog/2025/10/100000-wordpress-sites-affected-by-arbitrary-file-read-vulnerability-in-anti-malware-security-and-brute-force-firewall-wordpress-plugin/

Vendor Information

Anti-Malware Security and Brute-Force Firewall
https://www.wordfence.com/blog/2025/10/100000-wordpress-sites-affected-by-arbitrary-file-read-vulnerability-in-anti-malware-security-and-brute-force-firewall-wordpress-plugin/

References

WordFence
https://www.wordfence.com/blog/2025/10/100000-wordpress-sites-affected-by-arbitrary-file-read-vulnerability-in-anti-malware-security-and-brute-force-firewall-wordpress-plugin/

CVE Name
CVE-2025-11705

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India