# Anti-Spam by CleanTalk <= 6.90 - Unauthenticated Anti-Flood Bypass via Reusable Pass Cookie

- **ID:** WPSEC-2026-2029
- **Plugin:** Anti-Spam, Spam FireWall by CleanTalk (`cleantalk-spam-protect`), https://wordpress.org/plugins/cleantalk-spam-protect/
- **Affected versions:** all versions before 6.91
- **Fixed in:** 6.91 (Update to 6.91 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-565
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/cleantalk-spam-protect
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2029/

## Description

The Anti-Spam, Spam FireWall by CleanTalk plugin for WordPress is vulnerable to a Protection Mechanism Bypass via the Anti-Flood pass cookie in all versions up to, and including, 6.90. This is due to the 'apbct_antiflood_passed' value being a fixed hash of the visitor's IP address and the access key, printed on the Anti-Flood block page and accepted on every later request without expiry. This makes it possible for unauthenticated attackers who were shown the block page once to avoid rate limiting permanently while Anti-Flood is enabled.

## References

- https://wpsec.com/vuln/WPSEC-2026-2029/
- https://plugins.svn.wordpress.org/cleantalk-spam-protect/tags/6.91/
- https://wordpress.org/plugins/cleantalk-spam-protect/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2029/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.