CVE-2026-39478: Anti-Malware Security PHP Injection Flaw

CVE-2026-39478 Overview

CVE-2026-39478 is a PHP Object Injection vulnerability in the Anti-Malware Security and Brute-Force Firewall WordPress plugin (also known as GOTMLS) affecting versions 4.23.87 and earlier. The flaw stems from insecure deserialization of untrusted input [CWE-502] and can be triggered by an authenticated user with Contributor-level privileges. Successful exploitation allows an attacker to instantiate arbitrary PHP objects within the WordPress runtime. When a suitable POP (property-oriented programming) gadget chain exists in the application or loaded plugins, this leads to remote code execution, data tampering, or denial of service on the affected site.

Critical Impact
A Contributor-level account can trigger PHP Object Injection that may escalate to full site compromise when gadget chains are available, impacting confidentiality, integrity, and availability.

Affected Products

Anti-Malware Security and Brute-Force Firewall (GOTMLS) WordPress plugin versions <= 4.23.87
WordPress installations with the vulnerable plugin enabled
Multi-site WordPress environments granting Contributor or higher roles

Discovery Timeline

2026-06-15 - CVE-2026-39478 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-39478

Vulnerability Analysis

The vulnerability resides in code paths within the Anti-Malware Security and Brute-Force Firewall plugin that pass attacker-controllable input to PHP's unserialize() function or equivalent deserialization routines. Because PHP deserialization reconstructs objects and invokes magic methods such as __wakeup(), __destruct(), and __toString(), an attacker who controls the serialized payload can drive program flow into existing application classes.

The required privilege level is Contributor, a role that exists by default on most WordPress sites that accept guest authors. This significantly lowers the barrier for exploitation compared with vulnerabilities requiring administrator access. The attack is delivered over the network with low attack complexity and no user interaction.

When combined with gadget chains present in WordPress core, the plugin itself, or other installed plugins, the object injection can be chained into file writes, SQL execution, or arbitrary PHP code execution. See the Patchstack Vulnerability Report for additional context.

Root Cause

The root cause is unsafe deserialization of user-supplied data without prior validation or use of a safe parser. The plugin treats serialized strings as trusted, allowing an authenticated user to inject crafted serialized object graphs that the PHP runtime materializes into live objects.

Attack Vector

An attacker authenticates to the target WordPress site with a Contributor account, then sends a crafted request to a plugin endpoint that deserializes input. The payload contains a serialized PHP object referencing a class whose magic methods perform sensitive operations. Upon deserialization, those methods execute in the context of the web server process. No code example is provided here because no verified public proof of concept is available at the time of writing.

Detection Methods for CVE-2026-39478

Indicators of Compromise

Requests to wp-admin endpoints associated with the GOTMLS plugin containing serialized PHP payloads beginning with O:, a:, or s: patterns from Contributor accounts.
Unexpected PHP files written under wp-content/uploads/ or plugin directories after Contributor logins.
New or modified administrator accounts following access by lower-privileged users.
Outbound network connections from the web server process to attacker-controlled infrastructure shortly after plugin requests.

Detection Strategies

Inspect web server and PHP-FPM logs for POST bodies containing serialized object markers directed at plugin URLs.
Apply web application firewall rules that flag serialized PHP payloads in parameters submitted by non-administrator roles.
Compare installed plugin file hashes against the vendor distribution to detect tampering.
Correlate Contributor authentication events with anomalous file system or process activity on the host.

Monitoring Recommendations

Enable PHP error and access logging at a level that captures deserialization failures and class autoload events.
Forward WordPress audit logs, web server logs, and host telemetry to a centralized analytics platform for correlation.
Alert on creation of new PHP files in writable WordPress directories outside of scheduled update windows.
Track plugin version inventory across sites and flag any host still running GOTMLS <= 4.23.87.

How to Mitigate CVE-2026-39478

Immediate Actions Required

Update the Anti-Malware Security and Brute-Force Firewall plugin to a version later than 4.23.87 as soon as the vendor publishes a fixed release.
Audit user accounts and remove or downgrade Contributor accounts that are not strictly required.
Review web server and WordPress logs for prior exploitation attempts referencing serialized payloads.
Rotate WordPress secrets in wp-config.php and reset passwords for privileged accounts if compromise is suspected.

Patch Information

Refer to the Patchstack Vulnerability Report for the authoritative fixed-version information. Apply the vendor-supplied patch through the WordPress plugin updater or by deploying the corrected plugin package across all environments.

Workarounds

Disable the Anti-Malware Security and Brute-Force Firewall plugin until a patched version is installed.
Restrict access to plugin endpoints with WAF rules that block serialized PHP payloads from non-administrator sessions.
Enforce the principle of least privilege by limiting which users hold Contributor or higher roles.
Deploy a virtual patch via your WAF to reject requests containing O: or a: serialized object markers to plugin URIs.

bash

# Configuration example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate gotmls --all
wp plugin status gotmls