CVE-2025-11705: 
WordPress vulnerability analysis and mitigation

The Anti-Malware Security and Brute-Force Firewall plugin for WordPress version 4.23.83 addresses a missing capability check vulnerability in the admin-ajax API endpoint. The vulnerability was discovered and patched in October 2025, affecting versions prior to 4.23.83 (WordPress Plugin).

The vulnerability stemmed from inadequate permission validation in the admin-ajax API endpoint. The issue was resolved by implementing proper capability checks through the GOTMLSkillinvalid_user() function, which validates user authentication before allowing access to sensitive functionality. The update also included changes to URL handling for better compatibility with both HTTP and HTTPS sites (WordPress Plugin).

If exploited, the vulnerability could allow unauthorized users to access administrative functions through the admin-ajax API endpoint, potentially compromising the security of the WordPress installation (WordPress Plugin).

Users are advised to update to version 4.23.83 of the Anti-Malware Security and Brute-Force Firewall plugin, which includes the security fix for the missing capability check and improved URL handling (WordPress Plugin).