The Anti‑Malware Security and Brute‑Force Firewall plugin for WordPress contains a missing capability check that allows authenticated users, even at the Subscriber level, to read the contents of arbitrary files on the server. This flaw enables an attacker to view sensitive data such as configuration files, credentials, or other confidential information stored on the host. The weakness is a classic example of an access control failure (CWE‑862).

All versions of the scheeeli Anti‑Malware Security and Brute‑Force Firewall plugin up to and including 4.23.81 are affected. Users who have installed any of these releases on WordPress sites are vulnerable.

The CVSS score of 6.5 places this vulnerability in the moderate severity range. With an EPSS score of less than 1% and no presence in the CISA KEV catalog, the likelihood of exploitation is low, yet it remains exploitable for any authenticated Subscriber or higher user. The attack can be carried out by accessing vulnerable GOTMLS_* AJAX endpoints, which expose file contents without authorization checks. Successful exploitation results in information disclosure rather than code execution or denial of service.