EUVD-2026-36938
GHSA-752f-9j6f-hhw5
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable WordPress endpoint (AV:N), straightforward serialized payload (AC:L), Contributor account required (PR:L), no victim interaction (UI:N); successful object injection via gadget chain yields full CIA compromise.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
Contributor PHP Object Injection in Anti-Malware Security and Brute-Force Firewall <= 4.23.87 versions.
AnalysisAI
Authenticated PHP object injection in the WordPress 'Anti-Malware Security and Brute-Force Firewall' (GOTMLS) plugin through version 4.23.87 allows contributor-level users to inject crafted serialized PHP objects that are deserialized by the plugin. Successful exploitation can pivot through existing PHP gadget chains in WordPress or other installed plugins to achieve high-impact compromise of the site. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) the target WordPress site to have the Anti-Malware Security and Brute-Force Firewall (GOTMLS) plugin installed and active at version ≤ 4.23.87, (2) the attacker to hold valid credentials for a WordPress account with at least the Contributor role (matching CVSS PR:L) - anonymous exploitation is not possible, and (3) a usable PHP POP gadget chain to exist in WordPress core or another loaded plugin/theme on the target, since the plugin itself may not ship one capable of code execution. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Patchstack rates this 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting network-reachable, low-complexity exploitation by an authenticated user with low privileges (a WordPress Contributor) leading to full CIA impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers or compromises a low-privilege Contributor account on a WordPress site running GOTMLS ≤ 4.23.87, then submits a crafted request to a plugin endpoint containing a serialized PHP object designed to invoke a known POP gadget chain present in WordPress core or another installed plugin. When the plugin deserializes the input, the gadget chain triggers arbitrary file write or code execution, allowing the attacker to drop a webshell and take over the site. … |
| Remediation | Patch status: no vendor-released patched version is identified in the supplied data - neither the Patchstack entry nor the EUVD record cites a fixed release, so administrators should upgrade to the latest version published on wordpress.org that is newer than 4.23.87 once available and monitor the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/gotmls/vulnerability/wordpress-anti-malware-security-and-brute-force-firewall-plugin-4-23-87-php-object-injection-vulnerability) for the confirmed fix version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Conduct complete inventory of WordPress installations using GOTMLS ≤4.23.87; document affected sites and count active contributor-level user accounts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Stored cross-site scripting in the StarCitizenWiki EmbedVideo MediaWiki extension (versions <= 4.0.0) allows any user wi
Unrestricted PHP file upload in the MagicForm WordPress plugin (through version 0.1.3) enables unauthenticated remote co
Remote unauthenticated arbitrary file upload in JoomShaper SP Page Builder extension for Joomla (versions 1.0.0 through
Arbitrary PHP file upload in the iCagenda extension for Joomla enables remote unauthenticated attackers to abuse the eve
Unauthenticated PHP Object Injection in the ThemeREX Hot Coffee WordPress theme (versions ≤ 1.7) allows remote attackers
Share
External POC / Exploit Code
Leaving vuln.today