# Anti-Spam by CleanTalk <= 6.90 - Unauthenticated Sensitive Information Exposure via Contact Form 7 Mail Notification

- **ID:** WPSEC-2026-2020
- **Plugin:** Anti-Spam, Spam FireWall by CleanTalk (`cleantalk-spam-protect`), https://wordpress.org/plugins/cleantalk-spam-protect/
- **Affected versions:** all versions before 6.91
- **Fixed in:** 6.91 (Update to 6.91 or later.)
- **Severity:** Medium 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/cleantalk-spam-protect
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2020/

## Description

The Anti-Spam, Spam FireWall by CleanTalk plugin for WordPress is vulnerable to Sensitive Information Exposure via the Contact Form 7 mail notification in all versions up to, and including, 6.90, due to the apbct_form__contactForm7__changeMailNotification() filter adding the site owner's CleanTalk account user_token to a dashboard link and applying it to every mail component, including the Mail (2) autoresponder sent to the form submitter. The notice is added when the CleanTalk license is inactive and the submission is flagged as fast, blacklisted or sent without JavaScript. This makes it possible for unauthenticated attackers who submit a Contact Form 7 form with an autoresponder configured to receive the owner's CleanTalk dashboard token.

## References

- https://wpsec.com/vuln/WPSEC-2026-2020/
- https://plugins.svn.wordpress.org/cleantalk-spam-protect/tags/6.91/
- https://wordpress.org/plugins/cleantalk-spam-protect/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2020/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.