Anti-Spam by CleanTalk <= 6.90 - Unauthenticated Sensitive Information Exposure via Contact Form 7 Mail Notification
- ID
- WPSEC-2026-2020
- Plugin
- Anti-Spam, Spam FireWall by CleanTalk (cleantalk-spam-protect)
- Affected
- all versions before 6.91
- Remediation
- Update to 6.91 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-30
- Attack surface
- Anti-Spam by CleanTalk on WPSec AttackSurface
- Fix released
- Published
Description
The Anti-Spam, Spam FireWall by CleanTalk plugin for WordPress is vulnerable to Sensitive Information Exposure via the Contact Form 7 mail notification in all versions up to, and including, 6.90, due to the apbct_form__contactForm7__changeMailNotification() filter adding the site owner's CleanTalk account user_token to a dashboard link and applying it to every mail component, including the Mail (2) autoresponder sent to the form submitter. The notice is added when the CleanTalk license is inactive and the submission is flagged as fast, blacklisted or sent without JavaScript. This makes it possible for unauthenticated attackers who submit a Contact Form 7 form with an autoresponder configured to receive the owner's CleanTalk dashboard token.
References
- https://wpsec.com/vuln/WPSEC-2026-2020/
- https://plugins.svn.wordpress.org/cleantalk-spam-protect/tags/6.91/
- https://wordpress.org/plugins/cleantalk-spam-protect/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS