{
 "id": "WPSEC-2026-2020",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2020/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2020/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2020/index.md",
 "title": "Anti-Spam by CleanTalk <= 6.90 - Unauthenticated Sensitive Information Exposure via Contact Form 7 Mail Notification",
 "description": "The Anti-Spam, Spam FireWall by CleanTalk plugin for WordPress is vulnerable to Sensitive Information Exposure via the Contact Form 7 mail notification in all versions up to, and including, 6.90, due to the apbct_form__contactForm7__changeMailNotification() filter adding the site owner's CleanTalk account user_token to a dashboard link and applying it to every mail component, including the Mail (2) autoresponder sent to the form submitter. The notice is added when the CleanTalk license is inactive and the submission is flagged as fast, blacklisted or sent without JavaScript. This makes it possible for unauthenticated attackers who submit a Contact Form 7 form with an autoresponder configured to receive the owner's CleanTalk dashboard token.",
 "plugin": {
  "slug": "cleantalk-spam-protect",
  "name": "Anti-Spam by CleanTalk",
  "full_name": "Anti-Spam, Spam FireWall by CleanTalk",
  "wordpress_org": "https://wordpress.org/plugins/cleantalk-spam-protect/",
  "advisories_url": "https://wpsec.com/vuln/plugin/cleantalk-spam-protect/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/cleantalk-spam-protect"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.9,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "6.91",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 6.91"
  ]
 },
 "introduced_in": null,
 "fixed_in": "6.91",
 "remediation": "Update to 6.91 or later.",
 "fix_released": "2026-10-29T09:38:19+00:00",
 "published": "2026-10-30T09:42:55+00:00",
 "updated": "2026-10-29T17:46:25.364348+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2020/",
  "https://plugins.svn.wordpress.org/cleantalk-spam-protect/tags/6.91/",
  "https://wordpress.org/plugins/cleantalk-spam-protect/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/cleantalk-spam-protect",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-10-30"
 }
}