Read the docs
TI-2024-09765 Aliases CVE-2024-10542GHSA-r694-88f4-27hq

Missing authorization in cleantalk Spam protection, Honeypot, Anti-Spam by CleanTalk

Priority HIGH 65CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due to an authorization bypass via reverse DNS spoofing on the checkWithoutToken function in all versions up to, and including, 6.43.2. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.15364 96th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
cleantalkSpam protection, Honeypot, Anti-Spam by CleanTalkup to 6.43.2—No fix listedCNA
  • Spam protection, Honeypot, Anti-Spam by CleanTalk Vendorcleantalk Affected up to 6.43.2 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:cleantalk:anti-spam:*:*:*:*:*:wordpress:*:*before 6.44Vulnerablecleantalk
  • cpe:2.3:a:cleantalk:anti-spam:*:*:*:*:*:wordpress:*:* Versions before 6.44 Vulnerable ·cleantalk

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-10542
  2. 2026-10-03 Alias added: GHSA-r694-88f4-27hq

References

Patch 1

Advisory 1

Other 1

  • TI-2023-28342 Cross-site request forgery in СleanTalk - Anti-Spam Protection Spam protection… CVSS 3.1HIGH 8.8
  • TI-2021-06423 Anti-Spam by CleanTalk < 5.149 - Multiple Authenticated SQL Injections CVSS 3.1HIGH 7.2
  • TI-2026-09253 Anti-Spam by CleanTalk - Moderately critical - Cross site scripting - SA-CONTRIB-2026-042 CVSS 3.1MEDIUM 6.1
  • TI-2026-02776 Anti-Spam by CleanTalk - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-014 CVSS 3.1MEDIUM 4.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences