# Anti-Spam by CleanTalk <= 6.90 - Unauthenticated Protection Bypass via Forged Login Cookie

- **ID:** WPSEC-2026-2024
- **Plugin:** Anti-Spam, Spam FireWall by CleanTalk (`cleantalk-spam-protect`), https://wordpress.org/plugins/cleantalk-spam-protect/
- **Affected versions:** all versions before 6.91
- **Fixed in:** 6.91 (Update to 6.91 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-565
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/cleantalk-spam-protect
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2024/

## Description

The Anti-Spam, Spam FireWall by CleanTalk plugin for WordPress is vulnerable to a Protection Mechanism Bypass in all versions up to, and including, 6.90 due to the plugin treating a visitor as logged in whenever a 'wordpress_logged_in_' cookie with the site's cookie hash is present, without validating it. This makes it possible for unauthenticated attackers to have contacts protected by the Contacts Encoder shown unencoded and Force Protection turned off, and, when the 'protect logged-in users' setting is disabled, to skip anti-spam checks on form submissions.

## References

- https://wpsec.com/vuln/WPSEC-2026-2024/
- https://plugins.svn.wordpress.org/cleantalk-spam-protect/tags/6.91/
- https://wordpress.org/plugins/cleantalk-spam-protect/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2024/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.