A path traversal vulnerability in the Gotmls Anti-Malware plugin allows unauthenticated attackers to access sensitive files, posing a critical risk to site security.

This is a path traversal vulnerability (CWE-22) that does not require authentication (PR:N). An attacker can supply malicious input to trigger unauthorized file access, bypassing standard security restrictions.

The ability for an unauthenticated attacker to traverse the file system can lead to the exposure of sensitive configuration files, database credentials, or other critical system data. With a CVSS score of 7.5, this vulnerability represents a significant threat to confidentiality and should be addressed as a priority.

Immediate Action: Update the plugin to the latest version if available; if an update is not available, immediately deactivate and remove the plugin to prevent exploitation.

Proactive Monitoring: Monitor server logs for suspicious URL patterns containing directory traversal sequences (e.g., "../") directed at the plugin's file structure.

Compensating Controls: Deploy a WAF with rules configured to block common directory traversal strings and unauthorized access attempts to sensitive WordPress core files.

Public Exploit Available: Yes — an entry exists on ExploitDB (50107).

The combination of unauthenticated access and a public exploit necessitates urgent action. Administrators should verify their current version and update or remove the plugin immediately to mitigate the risk of unauthorized file exposure.