{
 "id": "WPSEC-2026-2022",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2022/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2022/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2022/index.md",
 "title": "Anti-Spam by CleanTalk <= 6.90 - Unauthenticated Anti-Crawler and Anti-Flood Bypass via Forged SpamFireWall Pass Cookie",
 "description": "The Anti-Spam, Spam FireWall by CleanTalk plugin for WordPress is vulnerable to a Protection Mechanism Bypass via the SpamFireWall pass cookie in all versions up to, and including, 6.90. This is due to the 'ct_sfw_pass_key' cookie being checked only against its md5 prefix while the whitelist status was read from an unsigned trailing character. This makes it possible for unauthenticated attackers to have the firewall treat them as whitelisted, which skips the Anti-Crawler and Anti-Flood modules when those are enabled.",
 "plugin": {
  "slug": "cleantalk-spam-protect",
  "name": "Anti-Spam by CleanTalk",
  "full_name": "Anti-Spam, Spam FireWall by CleanTalk",
  "wordpress_org": "https://wordpress.org/plugins/cleantalk-spam-protect/",
  "advisories_url": "https://wpsec.com/vuln/plugin/cleantalk-spam-protect/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/cleantalk-spam-protect"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-565"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "6.91",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 6.91"
  ]
 },
 "introduced_in": null,
 "fixed_in": "6.91",
 "remediation": "Update to 6.91 or later.",
 "fix_released": "2026-10-29T09:38:19+00:00",
 "published": "2026-10-30T09:42:55+00:00",
 "updated": "2026-10-29T17:46:25.364348+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2022/",
  "https://plugins.svn.wordpress.org/cleantalk-spam-protect/tags/6.91/",
  "https://wordpress.org/plugins/cleantalk-spam-protect/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/cleantalk-spam-protect",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-10-30"
 }
}