WordPress Plugin Vulnerability Lets Attackers Read Any Server File

A critical security flaw has been discovered in the Anti-Malware Security and Brute-Force Firewall WordPress plugin, identified as CVE-2025-11705, which allows authenticated attackers with basic subscriber-level access to read arbitrary files on the server, including wp-config.php. The vulnerability stems from a missing authorization check in the GOTMLS_ajax_scan() function used to display malware scan results, with nonce protection failing to fully block access for subscriber-level users.

Security researcher Dmitrii Ignatyev discovered the flaw and, according to Wordfence Bug Bounty Program, reported it on 3 October 2025, earning a $960 bounty. The plugin developer released patched version 4.23.83 on 15 October 2025, implementing proper capability checks through GOTMLS_kill_invalid_user() to ensure only users with appropriate permissions can perform sensitive file operations.

Wordfence Premium, Care, and Response users were protected against exploits from 14 October 2025, while the free version protection arrives on 13 November 2025 after a 30-day delay. The vulnerability affects all versions up to and including 4.23.81, so site administrators should update to 4.23.83 or later promptly. According to the article, this highlights the importance of timely plugin updates and monitoring security advisories.