Read the docs
TI-2022-03051 Aliases CVE-2022-3302GHSA-xxmh-c24j-hmf3

Anti-Spam by CleanTalk < 5.185.1 - Admin+ SQLi

Priority HIGH 67CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-89.

Summary

The Spam protection, AntiSpam, FireWall by CleanTalk WordPress plugin before 5.185.1 does not validate ids before using them in a SQL statement, which could lead to SQL injection exploitable by high privilege users such as admin

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01339 71st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Spam protection, AntiSpam, FireWall by CleanTalk (Unknown): 5.185.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownSpam protection, AntiSpam, FireWall by CleanTalk5.185.1 to before 5.185.15.185.1Patch availableCNA
  • Spam protection, AntiSpam, FireWall by CleanTalk VendorUnknown Affected 5.185.1 to before 5.185.1 Fixed in 5.185.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:cleantalk:spam_protection\,_antispam\,_firewall:*:*:*:*:*:wordpress:*:*before 5.185.1Vulnerablecleantalk
  • cpe:2.3:a:cleantalk:spam_protection\,_antispam\,_firewall:*:*:*:*:*:wordpress:*:* Versions before 5.185.1 Vulnerable ·cleantalk

Remediation

  • Fix · CNA Spam protection, AntiSpam, FireWall by CleanTalk (Unknown) Fixed in 5.185.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-3302
  2. 2026-10-03 Alias added: GHSA-xxmh-c24j-hmf3

References

Exploit 1

  • TI-2024-09993 Spam protection, Anti-Spam, FireWall by CleanTalk <= 6.44 - Authorization Bypass due to… CVSS 3.1HIGH 8.1
  • TI-2021-06587 Time-based Blind SQL Injection in Spam protection, AntiSpam, FireWall by CleanTalk < 5.153.4 CVSS 3.1HIGH 7.5
  • TI-2023-28187 Cross-site request forgery in СleanTalk - Anti-Spam Protection Spam protection… CVSS 3.1HIGH 8.8
  • TI-2019-13060 The CleanTalk cleantalk-spam-protect plugin before 5.127.4 for WordPress is affected by… CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences