Description

WordPress Plugin Anti-Malware Security and Brute-Force Firewall is prone to a local file inclusion vulnerability because it fails to sufficiently verify user-supplied input. Exploiting this issue may allow an attacker to obtain sensitive information that could aid in further attacks. WordPress Plugin Anti-Malware Security and Brute-Force Firewall version 4.18.63 is vulnerable; prior versions may also be affected.

Remediation

Disable the plugin until a fix is available

References

https://www.exploit-db.com/exploits/46618

https://packetstormsecurity.com/files/152296/WordPress-Anti-Malware-Security-And-Brute-Force-Firewall-4.18.63-Local-File-Inclusion.html

Related Vulnerabilities

WordPress Plugin Lazyest Gallery EXIF Code Cross-Site Scripting (1.1.20)

WordPress Plugin UK Cookie Cross-Site Request Forgery (1.1)

WordPress Plugin Premium Blocks for Gutenberg Unspecified Vulnerability (1.7.4)

WordPress Plugin Participants Database SQL Injection (1.9.5.5)

WordPress Plugin Booking.com Product Helper Unspecified Vulnerability (1.0.3)

Severity

High

Classification

CWE-22 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Tags

Missing Update File Inclusion