CVE-2021-47977 Gotmls CVE debrief

Who should care

WordPress site owners, administrators, and defenders running Anti-Malware Security and Bruteforce Firewall 4.20.59 or related deployments should treat this as a priority file-disclosure issue, especially where sensitive configuration, credential, or backup files may be present on the server.

Technical summary

The vulnerability is categorized as CWE-22 (path traversal). The supplied description says the plugin’s duplicator_download action in admin-ajax.php accepts a file parameter that can be manipulated with traversal sequences, allowing access to files outside the intended directory. NVD metadata in the supplied corpus lists a CVSS v4.0 vector of AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N, consistent with unauthenticated remote file-read exposure.

Defensive priority

High. The attack requires no privileges and can expose sensitive local files remotely, so affected deployments should be assessed and remediated quickly.

Recommended defensive actions

• Confirm whether Anti-Malware Security and Bruteforce Firewall 4.20.59 is installed on any public-facing WordPress instance.
• Upgrade to a vendor-fixed version if one is available; if not, disable or remove the plugin until a safe version can be deployed.
• Review web and application logs for requests to admin-ajax.php with duplicator_download and suspicious path traversal patterns in the file parameter.
• Check whether sensitive files such as wp-config.php, backup archives, or environment files could have been exposed and rotate secrets if disclosure is suspected.
• Apply least-privilege file permissions and limit exposure of administrative endpoints where feasible.
• Validate that compensating controls such as WAF rules and monitoring are in place to detect traversal-style requests.

Evidence notes

This debrief is based only on the supplied CVE description, the NVD metadata embedded in the source item, and the listed references. The corpus names CWE-22 and describes unauthenticated file disclosure through admin-ajax.php?action=duplicator_download with traversal sequences. The vendor attribution in the supplied metadata is low-confidence and marked for review; the product/version detail comes from the provided description.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.