# Anti-Spam by CleanTalk <= 6.90 - Unauthenticated Anti-Crawler and Anti-Flood Bypass via Forged SpamFireWall Pass Cookie

- **ID:** WPSEC-2026-2022
- **Plugin:** Anti-Spam, Spam FireWall by CleanTalk (`cleantalk-spam-protect`), https://wordpress.org/plugins/cleantalk-spam-protect/
- **Affected versions:** all versions before 6.91
- **Fixed in:** 6.91 (Update to 6.91 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-565
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/cleantalk-spam-protect
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2022/

## Description

The Anti-Spam, Spam FireWall by CleanTalk plugin for WordPress is vulnerable to a Protection Mechanism Bypass via the SpamFireWall pass cookie in all versions up to, and including, 6.90. This is due to the 'ct_sfw_pass_key' cookie being checked only against its md5 prefix while the whitelist status was read from an unsigned trailing character. This makes it possible for unauthenticated attackers to have the firewall treat them as whitelisted, which skips the Anti-Crawler and Anti-Flood modules when those are enabled.

## References

- https://wpsec.com/vuln/WPSEC-2026-2022/
- https://plugins.svn.wordpress.org/cleantalk-spam-protect/tags/6.91/
- https://wordpress.org/plugins/cleantalk-spam-protect/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2022/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.