What is the CVSS score of CVE-2026-39478?

CVE-2026-39478 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Anti-Malware Security and Brute-Force Firewall are affected by CVE-2026-39478?

The WordPress 'Anti-Malware Security and Brute-Force Firewall' (GOTMLS) plugin through version 4.23.87 is vulnerable to authenticated object injection attacks by contributor-level users, enabling…

How to fix or mitigate CVE-2026-39478?

Within 24 hours: Conduct complete inventory of WordPress installations using GOTMLS ≤4.23.87; document affected sites and count active contributor-level user accounts. Within 7 days: Either uninstall GOTMLS entirely or revoke contributor-level user permissions until patch; deploy WAF rules blocking PHP serialized object injection patterns. Within 30 days: Monitor official GOTMLS security advisory for patch release; upon availability, test and deploy patched version immediately; if no patch emerges within 30 days, migrate to alternative security plugin.

Anti-Malware Security and Brute-Force Firewall CVE-2026-39478

EUVD-2026-36938 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-15 Patchstack

GHSA-752f-9j6f-hhw5

PHP Deserialization Anti Malware Security And Brute Force Firewall

8.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable WordPress endpoint (AV:N), straightforward serialized payload (AC:L), Contributor account required (PR:L), no victim interaction (UI:N); successful object injection via gadget chain yields full CIA compromise.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 22:29 vuln.today

DescriptionCVE.org

Contributor PHP Object Injection in Anti-Malware Security and Brute-Force Firewall <= 4.23.87 versions.

AnalysisAI

Authenticated PHP object injection in the WordPress 'Anti-Malware Security and Brute-Force Firewall' (GOTMLS) plugin through version 4.23.87 allows contributor-level users to inject crafted serialized PHP objects that are deserialized by the plugin. Successful exploitation can pivot through existing PHP gadget chains in WordPress or other installed plugins to achieve high-impact compromise of the site. No public exploit identified at time of analysis, and the issue is not on the CISA KEV list.

Technical ContextAI

The vulnerability is a CWE-502 'Deserialization of Untrusted Data' flaw in a WordPress security plugin authored by Eli Scheetz (CPE cpe:2.3:a:eli_scheetz:anti-malware_security_and_brute-force_firewall). PHP object injection occurs when user-controlled input is passed to unserialize() (or equivalent functions like maybe_unserialize), causing PHP to instantiate arbitrary classes and invoke their magic methods (__wakeup, __destruct, __toString). On a WordPress site there are typically many loaded classes from core, themes and other plugins, providing 'POP gadget chains' that turn deserialization into file write, SQL execution, or arbitrary code execution. Ironically, this plugin is marketed as anti-malware/firewall protection, so the bug undermines a security control that is often broadly installed.

RemediationAI

Patch status: no vendor-released patched version is identified in the supplied data - neither the Patchstack entry nor the EUVD record cites a fixed release, so administrators should upgrade to the latest version published on wordpress.org that is newer than 4.23.87 once available and monitor the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/gotmls/vulnerability/wordpress-anti-malware-security-and-brute-force-firewall-plugin-4-23-87-php-object-injection-vulnerability) for the confirmed fix version. As compensating controls until the fix is applied: restrict or disable the Contributor role and any open user-registration flow that grants Contributor-or-higher access (trade-off: blocks legitimate guest authors); place the wp-admin endpoints used by the plugin behind IP allow-lists or a WAF rule that blocks serialized PHP payloads (e.g. requests containing 'O:' or 'a:' tokens in plugin parameters, with the trade-off of potential false positives on legitimate serialized data); and as a last resort, deactivate the GOTMLS plugin entirely, accepting the loss of its anti-malware scanning until a patched build is released.