Critical flaws reported in WordPress Anti-Spam plugin by Cleantalk
Take action: If you are using WordPress Anti-Spam plugin by Cleantalk, update ASAP. There are two easily exploitable flaws, with full public writeup. Don't delay.
Learn More
Worldfence reports two critical flaws in WordPress Anti-Spam by Cleantalk plugin.
- CVE-2024-10542 (CVSS score: 9.8) - A reverse DNS spoofing vulnerability allowing unauthenticated attackers to bypass authorization and install arbitrary plugins. The vulnerability stems from insufficient validation of reverse DNS lookups. The plugin uses the strpos() function to check if "cleantalk.org" appears anywhere in the hostname, making it possible to bypass security checks using subdomains like "cleantalk.org.malicious.domain".
- CVE-2024-10781 (CVSS score: 9.8) - An authentication bypass vulnerability exploiting empty API key validation, enabling attackers to gain unauthorized access. The vulnerability exists due to improper API key validation. When the API key is empty or not configured, the plugin still processes authorization tokens, allowing attackers to authenticate using a token matching an empty hash value.
The vulnerabilities affect Anti-Spam by Cleantalk plugin versions prior to 6.45, which is actively used on more than 200,000 WordPress websites. Version 6.44 only addresses the reverse DNS check vulnerability (CVE-2024-10542), while version 6.45, released in mid-November, patches both security flaws.
Both vulnerabilities allow unauthenticated attackers to install and activate arbitrary plugins, execute arbitrary code on vulnerable WordPress instances, potentially gain complete control of affected websites.
