- WordPress Plugin Flaw Allows Low-Privilege Users to Access Sensitive Server Credentials and Files
- CVE-2025-11705 impacts plugin variations 4.23.81 and earlier; patch launched October 15
- Some 50,000 websites stay susceptible; Administrators are urged to replace instantly.
A preferred WordPress plugin with over 100,000 energetic installations had a bug that allowed menace actors to learn any file on the server, together with individuals’s emails and, in some circumstances, passwords as effectively.
Security researchers at Wordfence reported a vulnerability within the Anti-Malware Security and Brute-Force Firewall plugin for WordPress. As the identify suggests, this plugin permits website house owners to scan for malware, shield their websites in opposition to brute pressure assaults, defend in opposition to identified flaws, and extra.
However, the plugin was lacking functionality checks in one among its capabilities, permitting low-privileged customers to learn arbitrary information on the server, together with delicate information like wp-config.php that shops completely different credentials.
Patch obtainable
In idea, malicious actors may receive individuals’s electronic mail addresses, hashed or plaintext passwords (relying on what’s saved), and different non-public information this fashion.
The bug is now tracked as CVE-2025-11705 and has a severity rating of 6.8/10 (medium), a comparatively low severity rating as attackers should authenticate with a purpose to abuse it, however websites with any kind of membership or subscription, operating the Anti-Malware Security and Brute-Force Firewall plugin, are thought-about susceptible.
Versions 4.23.81 and earlier of the plugin had been mentioned to be affected.
The researchers reported their findings to the seller on October 14, and a patch was launched a day later, on October 15. Version 2.23.83 fixes the bug by including a correct verification of consumer means through a brand new function. Since the patch was launched, about half of customers (round 50,000) have put in it, which means there are nonetheless round 50,000 susceptible web sites.
At the time of this publication, there have been no exploit information within the wild, however vulnerabilities like this are sometimes exploited months after patching. Therefore, web site directors are advisable to use the repair as quickly as doable.
Through beepcomputer
