CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
The Anti-Malware Security and Brute-Force Firewall plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 4.23.81 due to a missing capability check combined with an information exposure in several GOTMLS_* AJAX actions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Explanation of Vulnerability in Simple Terms
The Anti-Malware Security and Brute-Force Firewall plugin fails to properly check user permissions before allowing access to sensitive functions. An authenticated user with low privileges can read data they should not have access to. The vulnerability affects versions up to 4.23.81.
What an attacker can do
Read sensitive data they should not have access to.
Potential impact on your site
Authenticated users can access confidential information stored by the security plugin.
Conditions required to exploit
Attacker must have a low-privilege account on the site.
Key dates
External resources
Related vulnerabilities
