WordPress Anti-Malware Security and Brute-Force Firewall Arbitrary File Read Vulnerability

A vulnerability allowing arbitrary file read has been identified in the Anti-Malware Security and Brute-Force Firewall plugin for WordPress, affecting all versions through 4.23.81. The issue arises from a missing capability check and information exposure in several AJAX actions, which enables authenticated attackers with Subscriber-level access and above to read arbitrary files on the server that may contain sensitive information.

Impact

Exploitation of this vulnerability allows authenticated users with Subscriber-level access and above to read sensitive files on the server.

Remediation

Users are advised to update the plugin to version 4.23.83 or a newer patched version.