WordPress · Anti-Malware Security/Brute-Force Firewall · CVE-2021-47977
**Name of the Vulnerable Software and Affected Versions**
Anti-Malware Security and Bruteforce Firewall version 4.20.59
**Description**
A directory traversal issue allows unauthenticated attackers to read arbitrary files by manipulating the `file` parameter. Attackers can send requests to the 'duplicator download' action via the 'admin-ajax.php' endpoint using path traversal sequences to access sensitive system files outside the intended directory. Directory traversal is a technique that allows an attacker to read files on the server that are outside the web root folder.
**Recommendations**
At the moment, there is no information about a newer version that contains a fix for this vulnerability.