CVE-2026-39478 HIGH

CVE-2026-39478: WordPress Anti-Malware Security and Brute-Force Firewall plugin <= 4.23.87 - PHP Object Injection vulnerability

Vendor Eli Scheetz
Product Anti-Malware Security and Brute-Force Firewall
Weakness CWE-502 · Unsafe deserialization
Published June 15, 2026
Last update June 16, 2026
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Contributor PHP Object Injection in Anti-Malware Security and Brute-Force Firewall <= 4.23.87 versions.

Explanation of Vulnerability in Simple Terms

02Summary

The Anti-Malware Security and Brute-Force Firewall plugin contains a deserialization flaw that allows authenticated attackers to execute arbitrary PHP code on the site. An attacker with low-level access can craft malicious serialized data that, when processed by the plugin, runs their own code with full site privileges. This affects all versions up to 4.23.87.

What an attacker can do

03Attacker Capabilities

Run their own PHP code on the site with full administrative privileges.

Potential impact on your site

04Site Impact

Any authenticated user can take over the site, steal data, modify content, or install backdoors.

Conditions required to exploit

05Prerequisites

Attacker must have a low-level user account (subscriber, contributor, or equivalent) on the site.

Key dates

06Disclosure timeline

June 15, 2026 CVE published
June 16, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-39555 WordPress Askka theme <= 1.3.1 - PHP Object Injection vulnerability CVE-2026-39498 WordPress YayMail plugin <= 4.3.3 - PHP Object Injection vulnerability CVE-2026-27053 WordPress Broadcast Live Video plugin < 7.1.3 - PHP Object Injection vulnerability CVE-2026-49105 WordPress WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.4 - PHP Object Injection vulnerability CVE-2026-32510 WordPress Kamperen theme < 1.3 - Arbitrary Object Instantiation vulnerability