CVE-2025-11705 Overview
CVE-2025-11705 affects the Anti-Malware Security and Brute-Force Firewall plugin for WordPress in all versions up to and including 4.23.81. The vulnerability allows authenticated attackers with Subscriber-level access or higher to read arbitrary files on the server. The flaw results from a missing capability check combined with information exposure in several GOTMLS_* AJAX actions. Successful exploitation can disclose sensitive server files, including configuration files that may contain database credentials and secret keys. The issue is classified under CWE-862: Missing Authorization.
Critical Impact
Authenticated attackers with Subscriber-level privileges can read arbitrary files on the WordPress server, potentially exposing wp-config.php, credentials, and other sensitive data.
Affected Products
- Anti-Malware Security and Brute-Force Firewall plugin for WordPress
- All versions up to and including 4.23.81
- WordPress sites with Subscriber-level or higher account registration enabled
Discovery Timeline
- 2025-10-29 - CVE-2025-11705 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-11705
Vulnerability Analysis
The Anti-Malware Security and Brute-Force Firewall plugin, distributed under the gotmls slug, exposes several AJAX endpoints prefixed with GOTMLS_. These endpoints lack proper capability checks. Any authenticated user, including low-privilege Subscribers, can invoke them and reach code paths that return file contents. The plugin trusts user-supplied file path parameters and returns file data in the AJAX response.
The vulnerability combines two weaknesses. First, the AJAX handlers do not verify that the calling user has administrative rights over anti-malware operations. Second, the handlers return file contents to the response body when processing certain scan or view operations. Together, these flaws convert an administrative feature into an arbitrary file read primitive available to any authenticated account.
Root Cause
The root cause is a missing authorization check in the GOTMLS_* AJAX action handlers registered via wp_ajax_* hooks. The handlers rely on nonce presence but omit current_user_can() verification for capabilities such as manage_options. This leaves file-access functionality reachable by any authenticated session. See the CleanTalk CVE-2025-11705 Analysis and Wordfence Vulnerability Report for detailed technical breakdowns.
Attack Vector
The attack requires network access to the WordPress admin AJAX endpoint at /wp-admin/admin-ajax.php and a valid Subscriber-level session. An attacker registers or acquires a low-privilege account, obtains a valid nonce from an accessible page, and issues a POST request to the vulnerable GOTMLS_* action with a crafted file path parameter. The server returns the requested file contents. High-value targets include wp-config.php, .env files, private keys, and log files containing session tokens.
No verified proof-of-concept code is publicly linked in the referenced advisories. Refer to the CleanTalk analysis for exploitation walkthroughs.
Detection Methods for CVE-2025-11705
Indicators of Compromise
- POST requests to /wp-admin/admin-ajax.php with action parameters beginning with GOTMLS_ originating from Subscriber-level accounts
- HTTP responses from the AJAX endpoint containing file content signatures such as <?php, DB_PASSWORD, or AUTH_KEY
- Unusual read access patterns targeting wp-config.php, .htaccess, or files outside the plugin directory
- Newly registered Subscriber accounts followed by immediate AJAX activity against the plugin
Detection Strategies
- Inspect web server access logs for repeated admin-ajax.php requests referencing GOTMLS_ actions from non-administrative user sessions
- Deploy web application firewall rules that flag AJAX action names matching GOTMLS_* when invoked by low-privilege roles
- Correlate WordPress user role data with AJAX request telemetry to surface authorization mismatches
Monitoring Recommendations
- Monitor plugin version inventory to identify WordPress sites running vulnerable versions at or below 4.23.81
- Alert on outbound transfers of files matching WordPress configuration signatures from web server processes
- Track new user registrations paired with rapid AJAX endpoint enumeration within short time windows
How to Mitigate CVE-2025-11705
Immediate Actions Required
- Update the Anti-Malware Security and Brute-Force Firewall plugin to a version above 4.23.81 immediately
- Audit WordPress user accounts and remove unrecognized Subscriber-level or higher accounts
- Rotate secrets stored in wp-config.php, including database credentials and authentication salt keys, if compromise is suspected
- Review web server logs for prior exploitation attempts against GOTMLS_* AJAX actions
Patch Information
The vendor released a fix in the WordPress plugin changeset 3379118. Administrators should upgrade to the patched release through the WordPress plugin dashboard or by downloading the corrected version from the WordPress plugin repository. Verify the installed version after upgrade to confirm remediation.
Workarounds
- Disable open user registration on the WordPress site to reduce the pool of accounts capable of exploiting the flaw
- Temporarily deactivate the Anti-Malware Security and Brute-Force Firewall plugin until the patched version is applied
- Restrict access to /wp-admin/admin-ajax.php through IP allowlisting where feasible
- Enforce least-privilege role assignments and remove unused Subscriber accounts
# Example: disable open registration and update the plugin via WP-CLI
wp option update users_can_register 0
wp plugin update gotmls
wp plugin get gotmls --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
