CVE-2026-39478 Eli Scheetz CVE debrief

Who should care

Users of the Anti-Malware Security and Brute-Force Firewall plugin for WordPress, particularly those with Contributor-level access, should be aware of this vulnerability and take steps to mitigate it.

Technical summary

The CVE-2026-39478 vulnerability is a PHP Object Injection issue in the Anti-Malware Security and Brute-Force Firewall plugin for WordPress. It has been classified as HIGH severity with a CVSS score of 8.8. The vulnerability is exploitable by Contributors and can lead to high impact on confidentiality, integrity, and availability.

Defensive priority

HIGH

Recommended defensive actions

• Update the Anti-Malware Security and Brute-Force Firewall plugin to a version that is not vulnerable.
• Refer to [ref-4](https://patchstack.com/database/wordpress/plugin/gotmls/vulnerability/wordpress-anti-malware-security-and-brute-force-firewall-plugin-4-23-87-php-object-injection-vulnerability?_s_id=cve) for mitigation.

Evidence notes

The CVE-2026-39478 vulnerability was identified and reported by Patchstack.

Official resources