CVE-2026-39478: WordPress Anti-Malware Security and Brute-Force Firewall plugin <= 4.23.87 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection in the Anti-Malware Security and Brute-Force Firewall WordPress plugin (versions up to and including 4.23.87) allows a network-accessible attacker with a contributor-level account to trigger unsafe deserialization of PHP objects. The vulnerability is reachable over the network and requires only a low-privilege WordPress account, with no victim interaction needed. Successful exploitation gives the attacker full control over confidentiality, integrity, and availability of the affected site. No fix has been published yet; HarborGuard tracks the advisory and will make a patched-image rebuild available the moment an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, so the attacker must be able to reach the WordPress installation via HTTP/HTTPS from a remote host.

• AuthenticationRequired

  A low-privilege WordPress account at contributor level or above is sufficient; no administrative credentials are needed.

• Victim interactionNot required

  The attacker can trigger the vulnerability directly without requiring any action from another user or an administrator.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• Reads arbitrary site data including stored user credentials, session tokens, and private post content.
• Writes or modifies persisted database rows and WordPress configuration, enabling content defacement or privilege escalation.
• Executes arbitrary PHP code on the server if a suitable POP chain exists in the installed codebase, leading to full host compromise.
• Crashes or destabilizes the WordPress application, causing service disruption for site visitors and administrators.