{
 "id": "WPSEC-2026-2026",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2026/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2026/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2026/index.md",
 "title": "Anti-Spam by CleanTalk <= 6.90 - Unauthenticated Force Protection Bypass via Check Cookie",
 "description": "The Anti-Spam, Spam FireWall by CleanTalk plugin for WordPress is vulnerable to a Protection Mechanism Bypass via the Force Protection check in versions 6.48 up to, and including, 6.90. This is due to the plugin turning Force Protection off for iframe forms whenever the client-supplied 'apbct_force_protection_check' value is present, without verifying it. This makes it possible for unauthenticated attackers to submit iframe-embedded forms without Force Protection.",
 "plugin": {
  "slug": "cleantalk-spam-protect",
  "name": "Anti-Spam by CleanTalk",
  "full_name": "Anti-Spam, Spam FireWall by CleanTalk",
  "wordpress_org": "https://wordpress.org/plugins/cleantalk-spam-protect/",
  "advisories_url": "https://wpsec.com/vuln/plugin/cleantalk-spam-protect/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/cleantalk-spam-protect"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-565"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": "6.48",
    "from_inclusive": true,
    "to": "6.91",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 6.48 before 6.91"
  ]
 },
 "introduced_in": "6.48",
 "fixed_in": "6.91",
 "remediation": "Update to 6.91 or later.",
 "fix_released": "2026-10-29T09:38:19+00:00",
 "published": "2026-10-30T09:42:55+00:00",
 "updated": "2026-10-29T17:46:25.364348+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2026/",
  "https://plugins.svn.wordpress.org/cleantalk-spam-protect/tags/6.91/",
  "https://wordpress.org/plugins/cleantalk-spam-protect/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/cleantalk-spam-protect",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-10-30"
 }
}