{
 "id": "WPSEC-2026-2024",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2024/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2024/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2024/index.md",
 "title": "Anti-Spam by CleanTalk <= 6.90 - Unauthenticated Protection Bypass via Forged Login Cookie",
 "description": "The Anti-Spam, Spam FireWall by CleanTalk plugin for WordPress is vulnerable to a Protection Mechanism Bypass in all versions up to, and including, 6.90 due to the plugin treating a visitor as logged in whenever a 'wordpress_logged_in_' cookie with the site's cookie hash is present, without validating it. This makes it possible for unauthenticated attackers to have contacts protected by the Contacts Encoder shown unencoded and Force Protection turned off, and, when the 'protect logged-in users' setting is disabled, to skip anti-spam checks on form submissions.",
 "plugin": {
  "slug": "cleantalk-spam-protect",
  "name": "Anti-Spam by CleanTalk",
  "full_name": "Anti-Spam, Spam FireWall by CleanTalk",
  "wordpress_org": "https://wordpress.org/plugins/cleantalk-spam-protect/",
  "advisories_url": "https://wpsec.com/vuln/plugin/cleantalk-spam-protect/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/cleantalk-spam-protect"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-565"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "6.91",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 6.91"
  ]
 },
 "introduced_in": null,
 "fixed_in": "6.91",
 "remediation": "Update to 6.91 or later.",
 "fix_released": "2026-10-29T09:38:19+00:00",
 "published": "2026-10-30T09:42:55+00:00",
 "updated": "2026-10-29T17:46:25.364348+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2024/",
  "https://plugins.svn.wordpress.org/cleantalk-spam-protect/tags/6.91/",
  "https://wordpress.org/plugins/cleantalk-spam-protect/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/cleantalk-spam-protect",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-10-30"
 }
}