A critical vulnerability (CVE-2025-11705) was discovered in the Anti-Malware Security and Brute-Force Firewall WordPress plugin, affecting versions 4.23.81 and earlier. The flaw stemmed from missing capability checks, allowing low-privileged authenticated users (e.g., subscribers or members) to read arbitrary server files, including sensitive data like wp-config.php (containing database credentials, security keys, and other secrets).The exposure risk included email addresses, hashed/plaintext passwords, and other private user data stored on the server. While no active exploitation was reported at the time of disclosure, the vulnerability posed a high risk for credential theft, unauthorized access, or further attacks if abused. A patch (version 4.23.83) was released on October 15, but ~50,000 of the 100,000+ active installations remained unpatched, leaving them vulnerable.The bug received a CVSS score of 6.8 (Medium), though its real-world impact could escalate if attackers chained it with other exploits. WordPress admins were urged to update immediately to prevent potential breaches, data leaks, or account takeovers. The plugin’s widespread use amplified the risk, particularly for sites with membership systems or stored user credentials.