Anti-Malware Security and Brute-Force Firewall

Anti-Malware Security and Brute-Force Firewall has 11 disclosed vulnerabilities in the WordSec catalog, reported between 2015 and 2026; all 11 are fixed as of September 2026. Their average CVSS score is 6.6, and the most serious one scores 9.0 out of 10. Severity breakdown: 1 critical and 4 high. 2022 was the busiest year with 4 disclosures.

The most common weakness is Cross-Site Scripting, behind 6 of the records (55%). Other recurring categories include Deserialization Of Untrusted Data, Code Injection.

Every one of the 11 issues recorded for Anti-Malware Security and Brute-Force Firewall has a vendor fix available, so running the current release closes all known holes.

10 independent researchers contributed these findings, most of them (2) reported by James Hooker. Anti-Malware Security and Brute-Force Firewall is installed on roughly 100,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSMedium

6.6/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Anti-Malware Security and Brute-Force Firewall vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.0CVE-2024-22144

Anti-Malware Security and Brute-Force Firewall <= 4.21.96 - Unauthenticated Remote Code Execution

Read the full analysis

Vulnerability Records

11 records


2026-07-09 00:00	Anti-Malware Security and Brute-Force Firewall <= 4.23.89 - Unauthenticated Stored Cross-Site Scripting Anti-Malware Security and Brute-Force… <= 4.23.89	`CVE-2026-57691`	7.2 High	dutafi	Yes
2026-04-20 00:00	Anti-Malware Security and Brute-Force Firewall <= 4.23.87 - Authenticated (Contributor+) PHP Object Injection Anti-Malware Security and Brute-Force… <= 4.23.87	`CVE-2026-39478`	7.5 High	daroo	Yes
2025-10-28 15:41	Anti-Malware Security and Brute-Force Firewall <= 4.23.81 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read Anti-Malware Security and Brute-Force… <= 4.23.81	`CVE-2025-11705`	6.5 Medium	Dmitrii Ignatyev	Yes
2024-03-12 00:00	Anti-Malware Security and Brute-Force Firewall <= 4.21.96 - Unauthenticated Remote Code Execution Anti-Malware Security and Brute-Force… <= 4.21.96	`CVE-2024-22144`	9.0 Critical	stealthcopter	Yes
2022-12-21 00:00	Anti-Malware Security and Brute-Force Firewall <= 4.21.85 - Authenticated (Admin+) PHP Object Injection Anti-Malware Security and Brute-Force… <= 4.21.85	`CVE-2022-4327`	7.2 High	thinhnguyen1337	Yes
2022-04-11 00:00	Anti-Malware Security and Brute-Force Firewall <= 4.20.95 - Reflected Cross-Site Scripting Anti-Malware Security and Brute-Force… < 4.20.96	`CVE-2022-0953`	6.1 Medium	Taurus Omar	Yes
2022-02-08 00:00	Anti-Malware Security and Brute-Force Firewall <= 4.21.74 - Reflected Cross-Site Scripting Anti-Malware Security and Brute-Force… <= 4.21.74	`CVE-2022-2599`	6.1 Medium	Krzysztof Zając	Yes
2022-01-24 00:00	Anti-Malware Security and Brute-Force Firewall <= 4.20.93 - Reflected Cross-Site Scripting Anti-Malware Security and Brute-Force… < 4.20.94	`CVE-2021-25101`	6.1 Medium	ZhongFu Su	Yes
2016-05-10 00:00	Anti-Malware Security and Brute-Force Firewall <= 4.15.17 - Cross-Site Scripting Anti-Malware Security and Brute-Force… <= 4.15.17	`N/A`	7.2 High	Tim Coen	Yes
2015-05-25 00:00	Anti-Malware Security and Brute-Force Firewall <= 4.15.22 - Cross-Site Request Forgery Anti-Malware Security and Brute-Force… < 4.15.23	`N/A`	3.1 Low	James Hooker	Yes

Showing 1–10 of 11 reports

Latestv4.23.90

Anti-Malware Security and Brute-Force Firewall

Author

Eli

4.9(783)

98/100

Last Updated

2026-06-29 (3mo ago)

Active Installs

100,000+

Downloads

7,908,249

Requires WP

3.3+

Requires PHP

5.6+

Tested up to

WP 7.0.4

Created

2012-03-27 (15y ago)

Features: Download Definition Updates to protect against new threats. Run a Complete Scan to automatically remove known security threats, backdoor scripts, and database injections. Firewall block SoakSoak and other malware from exploiting Revolution Slider and other plugins with known vulnerabilites. Upgrade vulnerable versions of timthumb scripts. Premium Features: Patch your wp-login and XMLRPC to block Brute-Force and DDoS attacks. Check the integrity of your WordPress Core files. Automatically download new Definition Updates when running a Complete Scan. Register this plugin at GOTMLS.NET and get access to new definitions of “Known Threats” and added features like Automatic Removal, plus patches for specific security vulnerabilities like old versions of timthumb. Updated definition files can be downloaded automatically within the admin once your Key is registered. Otherwise, this plugin just scans for “Potential Threats” and leaves it up to you to identify and remove the malicious ones. NOTICE: This plugin makes calls to GOTMLS.NET to check for updates not unlike what WordPress does when checking your plugins and themes for new versions. Staying up-to-date is an essential part of any security plugin and this plugin can let you know when there are new plugin and definition update available. If you’re allergic to “phone home” scripts then don’t use this plugin (or WordPress at all for that matter). Special thanks to: Clarus Dignus for design suggestions and graphic design work on the banner image. Jelena Kovacevic and Andrew Kurtis of webhostinghub.com for providing the Spanish translation. Marcelo Guernieri for the Brazilian Portuguese translation. Umut Can Alparslan for the Turkish translation. Micha Cassola for the German translation. Robi Erwin Setiawan for the Indonesian translation.

View on WordPress.org