TI-2021-06587 Aliases CVE-2021-24295 GHSA-3897-7ph5-mf8c

Time-based Blind SQL Injection in Spam protection, AntiSpam, FireWall by CleanTalk < 5.153.4

MEDIUM 41CWE-89Published 2021-05-17 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: SQL injection
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-89.

Summary

It was possible to exploit an Unauthenticated Time-Based Blind SQL Injection vulnerability in the Spam protection, AntiSpam, FireWall by CleanTalk WordPress Plugin before 5.153.4. The update_log function in lib/Cleantalk/ApbctWP/Firewall/SFW.php included a vulnerable query that could be injected via the User-Agent Header by manipulating the cookies set by the Spam protection, AntiSpam, FireWall by CleanTalk WordPress plugin before 5.153.4, sending an initial request to obtain a ct_sfw_pass_key cookie and then manually setting a separate ct_sfw_passed cookie and disallowing it from being reset.

Why it matters now

EPSS 0.05612 92nd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed Spam protection, AntiSpam, FireWall by CleanTalk (СleanTalk): 5.153.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
СleanTalk	Spam protection, AntiSpam, FireWall by CleanTalk	5.153.4 to before 5.153.4	5.153.4	Patch available	CNA

Spam protection, AntiSpam, FireWall by CleanTalk VendorСleanTalk Affected 5.153.4 to before 5.153.4 Fixed in 5.153.4 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:cleantalk:spam_protection\,_antispam\,_firewall::::::wordpress::*	before 5.153.4	Vulnerable	cleantalk

cpe:2.3:a:cleantalk:spam_protection\,_antispam\,_firewall:*:*:*:*:*:wordpress:*:* Versions before 5.153.4 Vulnerable ·cleantalk

Remediation

Fix · CNA Spam protection, AntiSpam, FireWall by CleanTalk (СleanTalk) Fixed in 5.153.4

Timeline

2026-10-02 Threatist record created from CVE-2021-24295
2026-10-03 Alias added: GHSA-3897-7ph5-mf8c

References

Exploit 1

https://www.wordfence.com/blog/2021/05/sql-injection-vulnerability-patched-in-cleantalk-antispam-plugin/

Advisory 1

https://wpscan.com/vulnerability/152171fc-888c-4275-a118-5a1e664ef28b

TI-2022-03051 Anti-Spam by CleanTalk < 5.185.1 - Admin+ SQLi CVSS 3.1HIGH 7.2
TI-2024-09993 Spam protection, Anti-Spam, FireWall by CleanTalk <= 6.44 - Authorization Bypass due to… CVSS 3.1HIGH 8.1
TI-2023-28187 Cross-site request forgery in СleanTalk - Anti-Spam Protection Spam protection… CVSS 3.1HIGH 8.8
TI-2019-13060 The CleanTalk cleantalk-spam-protect plugin before 5.127.4 for WordPress is affected by… CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences