Executive Summary

In a case of security software being insecure, a critical vulnerability has been found in the Anti-Malware Security and Brute-Force Firewall (GOTMLS) plugin for WordPress. The flaw, tracked as CVE-2025-11705, is an arbitrary file reading vulnerability that affects over 100,000 websites. The vulnerability allows any authenticated user, regardless of their permission level (including basic 'Subscribers'), to read any file on the web server that is accessible to the web server process. This critically includes the wp-config.php file, which contains database credentials and authentication salts. Access to this file can lead to a complete compromise of the website. The issue was discovered by the CleanTalk research team, and users must update the plugin immediately.

Vulnerability Details

• CVE ID: CVE-2025-11705
• Vulnerability Type: Broken Access Control / Arbitrary File Read
• Affected Component: GOTMLS_View_Quarantine AJAX action
• Required Privileges: Any authenticated user (e.g., Subscriber)

The vulnerability exists because the AJAX function GOTMLS_View_Quarantine fails to perform proper capability checks. This function is intended for administrators to view quarantined files. However, the developers did not correctly restrict its access, making it available to any logged-in user. Furthermore, the function lacks proper input validation and path traversal protection. An attacker can manipulate the input to this function to specify an arbitrary file path on the server. The function will then read the contents of that file and return it in the HTTP response.

The most critical attack scenario is reading the wp-config.php file. This file contains:

• Database name, username, and password.
• WordPress unique keys and salts for authentication.

With this information, an attacker can connect directly to the website's database to steal or modify data, create new admin users, or use the authentication salts to forge login cookies.

Affected Systems

• Product: Anti-Malware Security and Brute-Force Firewall (GOTMLS)
• Affected Versions: All versions up to and including the latest unpatched version.
• Status: A patched version has been released, and users must update.

Exploitation Status

The vulnerability details are public, making it highly likely that threat actors will begin scanning for and exploiting vulnerable websites. The low privilege requirement makes it easy to exploit; an attacker only needs to register a free subscriber account on a target site, a feature that is enabled on many blogs and forums.

Impact Assessment

The impact of exploiting CVE-2025-11705 is critical. By reading the wp-config.php file, an attacker gains the keys to the kingdom. This can lead to:

• Full Database Compromise: Attackers can read, modify, or delete all data in the website's database, including user PII, orders, and posts.
• Complete Site Takeover: By creating a new administrator account in the database, the attacker gains full control over the WordPress site.
• Further Attacks: The compromised site can be used as a platform for malware distribution, phishing, or as a pivot point into the hosting environment.

The irony of a security plugin introducing such a severe vulnerability undermines user trust and highlights the importance of code quality and security audits for all software, especially security tools.

Cyber Observables for Detection

Detection Methods

• Plugin Version Check: The most reliable way to identify vulnerable sites is to check the version of the GOTMLS plugin. Administrators should ensure they are running the latest patched version.
• Log Analysis: Review admin-ajax.php access logs. Filter for requests with action=GOTMLS_View_Quarantine and inspect the user ID and role associated with the request. Any request from a user who is not an administrator is a sign of an exploit attempt. This is a form of D3FEND Protocol Analysis.
• WAF Rules: A Web Application Firewall can be configured to block requests to admin-ajax.php that contain path traversal characters (../) in their parameters, which would block this specific exploit vector.

Remediation Steps

1. Update Immediately: The only proper remediation is to update the 'Anti-Malware Security and Brute-Force Firewall' plugin to the latest version through the WordPress dashboard.
2. Assume Compromise and Rotate Credentials: If you were running a vulnerable version, you must assume that your wp-config.php file has been compromised. Immediately rotate your database password, and all WordPress authentication keys and salts. This will invalidate all existing user sessions and database connections.
3. Audit User Accounts: After rotating credentials, thoroughly audit all user accounts in your WordPress database for any unauthorized accounts, especially those with administrator privileges.
4. Scan Website: Perform a full scan of your website files and database to look for any backdoors or malicious content that may have been planted by an attacker.