Vulnerabilities / Anti-Spam by CleanTalk / WPSEC-2026-2029
Anti-Spam by CleanTalk <= 6.90 - Unauthenticated Anti-Flood Bypass via Reusable Pass Cookie
Low 3.7
CWE-565Fixed in 6.91
- ID
- WPSEC-2026-2029
- Plugin
- Anti-Spam, Spam FireWall by CleanTalk (cleantalk-spam-protect)
- Affected
- all versions before 6.91
- Remediation
- Update to 6.91 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-565
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-30
- Attack surface
- Anti-Spam by CleanTalk on WPSec AttackSurface
- Fix released
- Published
Description
The Anti-Spam, Spam FireWall by CleanTalk plugin for WordPress is vulnerable to a Protection Mechanism Bypass via the Anti-Flood pass cookie in all versions up to, and including, 6.90. This is due to the 'apbct_antiflood_passed' value being a fixed hash of the visitor's IP address and the access key, printed on the Anti-Flood block page and accepted on every later request without expiry. This makes it possible for unauthenticated attackers who were shown the block page once to avoid rate limiting permanently while Anti-Flood is enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-2029/
- https://plugins.svn.wordpress.org/cleantalk-spam-protect/tags/6.91/
- https://wordpress.org/plugins/cleantalk-spam-protect/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS