CVE-2025-11705: CWE-862 Missing Authorization in scheeeli Anti-Malware Security and Brute-Force Firewall
The Anti-Malware Security and Brute-Force Firewall plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 4.23.81 due to a missing capability check combined with an information exposure in several GOTMLS_* AJAX actions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
AI Analysis
Technical Summary
The Anti-Malware Security and Brute-Force Firewall plugin for WordPress suffers from a missing authorization (CWE-862) vulnerability in multiple GOTMLS_* AJAX actions. This flaw permits authenticated users with low privileges (Subscriber-level and above) to perform arbitrary file reads on the server. The issue arises from the absence of proper capability checks combined with information exposure in these AJAX endpoints. The vulnerability affects all versions up to and including 4.23.81 and has a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Potential Impact
An attacker with at least Subscriber-level access to a WordPress site using the vulnerable plugin can read arbitrary files on the server. This may expose sensitive information such as configuration files, credentials, or other data stored on the server. The vulnerability does not allow modification or denial of service but compromises confidentiality.
Mitigation Recommendations
Patch status is not yet confirmed — no official patch or vendor advisory is currently available. Users should monitor the vendor's official channels for updates and apply any forthcoming patches promptly. Until a fix is released, restrict Subscriber-level access where possible and consider disabling the plugin if feasible.
CVE-2025-11705: CWE-862 Missing Authorization in scheeeli Anti-Malware Security and Brute-Force Firewall
Description
The Anti-Malware Security and Brute-Force Firewall plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 4.23.81 due to a missing capability check combined with an information exposure in several GOTMLS_* AJAX actions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Anti-Malware Security and Brute-Force Firewall plugin for WordPress suffers from a missing authorization (CWE-862) vulnerability in multiple GOTMLS_* AJAX actions. This flaw permits authenticated users with low privileges (Subscriber-level and above) to perform arbitrary file reads on the server. The issue arises from the absence of proper capability checks combined with information exposure in these AJAX endpoints. The vulnerability affects all versions up to and including 4.23.81 and has a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Potential Impact
An attacker with at least Subscriber-level access to a WordPress site using the vulnerable plugin can read arbitrary files on the server. This may expose sensitive information such as configuration files, credentials, or other data stored on the server. The vulnerability does not allow modification or denial of service but compromises confidentiality.
Mitigation Recommendations
Patch status is not yet confirmed — no official patch or vendor advisory is currently available. Users should monitor the vendor's official channels for updates and apply any forthcoming patches promptly. Until a fix is released, restrict Subscriber-level access where possible and consider disabling the plugin if feasible.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- Wordfence
- Date Reserved
- 2025-10-13T19:18:31.121Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 69019e3e14defc143b8e553c
Added to database: 10/29/2025, 4:55:26 AM
Last enriched: 4/9/2026, 9:07:38 AM
Last updated: 5/10/2026, 5:21:47 AM
Views: 360
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.