The vulnerability arises because the WordPress Anti‑Malware Security and Bruteforce Firewall plugin fails to cleanse a filename supplied to its duplicator_download action. An attacker can send a crafted HTTP request containing path‑traversal sequences that bypass the intended directory boundaries and read any file the web server can access, such as sensitive configuration files or logs. While the flaw does not provide direct code execution, the ability to read arbitrary files can lead to credential theft, information disclosure, and facilitate further attacks. The weakness is classified as CWE‑22.

The 4.20.59 release of the WordPress Anti‑Malware Security and Bruteforce Firewall plugin from Gotmls is explicitly listed as vulnerable. Only this version is identified; newer releases are assumed patched.

The flaw carries a CVSS score of 8.7, indicating high severity. No EPSS score is available and the vulnerability is not included in CISA’s KEV catalog, suggesting no confirmed exploitation yet. An attacker merely needs to send an unauthenticated request to admin‑ajax.php specifying the duplicator_download action with a file path that contains traversal characters to obtain sensitive files. Once a file is read, attackers can obtain information that may support further exploits.