CVE-2026-39478

The Anti-Malware Security and Brute-Force Firewall WordPress plugin contains a vulnerability that allows attackers with contributor-level access or higher to inject malicious PHP objects into the application through untrusted input deserialization in versions up to 4.23.87. This flaw enables potential exploitation of additional vulnerabilities present on the system, such as those introduced by other plugins or themes, which could lead to file deletion, data retrieval, or code execution.

Based on public CVE data (MITRE/NVD).