Vulnerabilities / Anti-Spam by CleanTalk / WPSEC-2026-2026
Anti-Spam by CleanTalk <= 6.90 - Unauthenticated Force Protection Bypass via Check Cookie
Low 3.7
CWE-565Fixed in 6.91
- ID
- WPSEC-2026-2026
- Plugin
- Anti-Spam, Spam FireWall by CleanTalk (cleantalk-spam-protect)
- Affected
- from 6.48 before 6.91
- Remediation
- Update to 6.91 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-565
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-30
- Attack surface
- Anti-Spam by CleanTalk on WPSec AttackSurface
- Fix released
- Published
Description
The Anti-Spam, Spam FireWall by CleanTalk plugin for WordPress is vulnerable to a Protection Mechanism Bypass via the Force Protection check in versions 6.48 up to, and including, 6.90. This is due to the plugin turning Force Protection off for iframe forms whenever the client-supplied 'apbct_force_protection_check' value is present, without verifying it. This makes it possible for unauthenticated attackers to submit iframe-embedded forms without Force Protection.
References
- https://wpsec.com/vuln/WPSEC-2026-2026/
- https://plugins.svn.wordpress.org/cleantalk-spam-protect/tags/6.91/
- https://wordpress.org/plugins/cleantalk-spam-protect/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS