Anti-Malware Security and Brute-Force Firewall <= 4.23.90 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Firewall Definitions
- ID
- WPSEC-2026-1631
- Plugin
- Anti-Malware Security and Brute-Force Firewall (gotmls)
- Affected
- all versions before 4.23.91
- Remediation
- Update to 4.23.91 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-352
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-25
- Attack surface
- Anti-Malware Security and Brute-Force Firewall on WPSec AttackSurface
- Fix released
- Published
Description
The Anti-Malware Security and Brute-Force Firewall plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Stored Cross-Site Scripting via the definitions update and Firewall Options page in all versions up to, and including, 4.23.90. This is due to two causes. Nonce tokens were not strictly bound to their owner: a loose comparison let a token issued to an unauthenticated visitor's spoofable IP address validate for a logged-in administrator. Firewall definition keys and descriptions were also output into HTML and an onclick JavaScript context without escaping. This makes it possible for unauthenticated attackers to replace the plugin's definitions and inject arbitrary web scripts that execute in an administrator's browser, if they can trick an administrator into performing an action such as clicking a link.
References
- https://wpsec.com/vuln/WPSEC-2026-1631/
- https://plugins.svn.wordpress.org/gotmls/tags/4.23.91/
- https://wordpress.org/plugins/gotmls/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS