# Anti-Spam by CleanTalk <= 6.90 - Unauthenticated Force Protection Bypass via Check Cookie

- **ID:** WPSEC-2026-2026
- **Plugin:** Anti-Spam, Spam FireWall by CleanTalk (`cleantalk-spam-protect`), https://wordpress.org/plugins/cleantalk-spam-protect/
- **Affected versions:** from 6.48 before 6.91
- **Fixed in:** 6.91 (Update to 6.91 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-565
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/cleantalk-spam-protect
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2026/

## Description

The Anti-Spam, Spam FireWall by CleanTalk plugin for WordPress is vulnerable to a Protection Mechanism Bypass via the Force Protection check in versions 6.48 up to, and including, 6.90. This is due to the plugin turning Force Protection off for iframe forms whenever the client-supplied 'apbct_force_protection_check' value is present, without verifying it. This makes it possible for unauthenticated attackers to submit iframe-embedded forms without Force Protection.

## References

- https://wpsec.com/vuln/WPSEC-2026-2026/
- https://plugins.svn.wordpress.org/cleantalk-spam-protect/tags/6.91/
- https://wordpress.org/plugins/cleantalk-spam-protect/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2026/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.