{
 "id": "WPSEC-2026-2029",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2029/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2029/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2029/index.md",
 "title": "Anti-Spam by CleanTalk <= 6.90 - Unauthenticated Anti-Flood Bypass via Reusable Pass Cookie",
 "description": "The Anti-Spam, Spam FireWall by CleanTalk plugin for WordPress is vulnerable to a Protection Mechanism Bypass via the Anti-Flood pass cookie in all versions up to, and including, 6.90. This is due to the 'apbct_antiflood_passed' value being a fixed hash of the visitor's IP address and the access key, printed on the Anti-Flood block page and accepted on every later request without expiry. This makes it possible for unauthenticated attackers who were shown the block page once to avoid rate limiting permanently while Anti-Flood is enabled.",
 "plugin": {
  "slug": "cleantalk-spam-protect",
  "name": "Anti-Spam by CleanTalk",
  "full_name": "Anti-Spam, Spam FireWall by CleanTalk",
  "wordpress_org": "https://wordpress.org/plugins/cleantalk-spam-protect/",
  "advisories_url": "https://wpsec.com/vuln/plugin/cleantalk-spam-protect/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/cleantalk-spam-protect"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-565"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "6.91",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 6.91"
  ]
 },
 "introduced_in": null,
 "fixed_in": "6.91",
 "remediation": "Update to 6.91 or later.",
 "fix_released": "2026-10-29T09:38:19+00:00",
 "published": "2026-10-30T09:42:55+00:00",
 "updated": "2026-10-29T17:46:25.364348+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2029/",
  "https://plugins.svn.wordpress.org/cleantalk-spam-protect/tags/6.91/",
  "https://wordpress.org/plugins/cleantalk-spam-protect/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/cleantalk-spam-protect",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-10-30"
 }
}