Vulnerabilities / Anti-Spam by CleanTalk / WPSEC-2026-2022
Anti-Spam by CleanTalk <= 6.90 - Unauthenticated Anti-Crawler and Anti-Flood Bypass via Forged SpamFireWall Pass Cookie
Low 3.7
CWE-565Fixed in 6.91
- ID
- WPSEC-2026-2022
- Plugin
- Anti-Spam, Spam FireWall by CleanTalk (cleantalk-spam-protect)
- Affected
- all versions before 6.91
- Remediation
- Update to 6.91 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-565
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-30
- Attack surface
- Anti-Spam by CleanTalk on WPSec AttackSurface
- Fix released
- Published
Description
The Anti-Spam, Spam FireWall by CleanTalk plugin for WordPress is vulnerable to a Protection Mechanism Bypass via the SpamFireWall pass cookie in all versions up to, and including, 6.90. This is due to the 'ct_sfw_pass_key' cookie being checked only against its md5 prefix while the whitelist status was read from an unsigned trailing character. This makes it possible for unauthenticated attackers to have the firewall treat them as whitelisted, which skips the Anti-Crawler and Anti-Flood modules when those are enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-2022/
- https://plugins.svn.wordpress.org/cleantalk-spam-protect/tags/6.91/
- https://wordpress.org/plugins/cleantalk-spam-protect/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS