Read the docs
TI-2021-06423 Aliases CVE-2021-24131GHSA-hv83-f95q-qg45

Anti-Spam by CleanTalk < 5.149 - Multiple Authenticated SQL Injections

Priority LOW 35CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-89.

Summary

Unvalidated input in the Anti-Spam by CleanTalk WordPress plugin, versions before 5.149, lead to multiple authenticated SQL injection vulnerabilities, however, it requires high privilege user (admin+).

Why it matters now

EPSS 0.01444 73rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Anti-Spam by CleanTalk (Unknown): 5.149

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownAnti-Spam by CleanTalk5.149 to before 5.1495.149Patch availableCNA
  • Anti-Spam by CleanTalk VendorUnknown Affected 5.149 to before 5.149 Fixed in 5.149 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:cleantalk:anti-spam:*:*:*:*:*:wordpress:*:*before 5.149Vulnerablecleantalk
  • cpe:2.3:a:cleantalk:anti-spam:*:*:*:*:*:wordpress:*:* Versions before 5.149 Vulnerable ·cleantalk

Remediation

  • Fix · CNA Anti-Spam by CleanTalk (Unknown) Fixed in 5.149

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-24131
  2. 2026-10-03 Alias added: GHSA-hv83-f95q-qg45

References

Exploit 1

  • TI-2024-09765 Missing authorization in cleantalk Spam protection, Honeypot, Anti-Spam by CleanTalk CVSS 3.1CRITICAL 9.8
  • TI-2023-28342 Cross-site request forgery in СleanTalk - Anti-Spam Protection Spam protection… CVSS 3.1HIGH 8.8
  • TI-2026-09253 Anti-Spam by CleanTalk - Moderately critical - Cross site scripting - SA-CONTRIB-2026-042 CVSS 3.1MEDIUM 6.1
  • TI-2026-02776 Anti-Spam by CleanTalk - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-014 CVSS 3.1MEDIUM 4.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences