WordPress security plugin exposes private data to site subscribers

An authenticated low-privilege file disclosure vulnerability (CVE-2025-11705) in the Anti-Malware Security and Brute-Force Firewall WordPress plugin allows subscribers to read arbitrary server files (including wp-config.php). The developer released version 4.23.83 to add proper capability checks; roughly 50,000 sites may still be running vulnerable versions and administrators are advised to apply the patch immediately.