Vulnerabilities / Anti-Spam by CleanTalk / WPSEC-2026-2024
Anti-Spam by CleanTalk <= 6.90 - Unauthenticated Protection Bypass via Forged Login Cookie
Medium 5.3
CWE-565Fixed in 6.91
- ID
- WPSEC-2026-2024
- Plugin
- Anti-Spam, Spam FireWall by CleanTalk (cleantalk-spam-protect)
- Affected
- all versions before 6.91
- Remediation
- Update to 6.91 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-565
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-30
- Attack surface
- Anti-Spam by CleanTalk on WPSec AttackSurface
- Fix released
- Published
Description
The Anti-Spam, Spam FireWall by CleanTalk plugin for WordPress is vulnerable to a Protection Mechanism Bypass in all versions up to, and including, 6.90 due to the plugin treating a visitor as logged in whenever a 'wordpress_logged_in_' cookie with the site's cookie hash is present, without validating it. This makes it possible for unauthenticated attackers to have contacts protected by the Contacts Encoder shown unencoded and Force Protection turned off, and, when the 'protect logged-in users' setting is disabled, to skip anti-spam checks on form submissions.
References
- https://wpsec.com/vuln/WPSEC-2026-2024/
- https://plugins.svn.wordpress.org/cleantalk-spam-protect/tags/6.91/
- https://wordpress.org/plugins/cleantalk-spam-protect/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS