Read the docs
TI-2024-09792 Aliases CVE-2024-10570GHSA-c987-4q4r-p52g

SQL injection in cleantalk Login Security, FireWall, Malware removal by CleanTalk

Priority MEDIUM 40CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

The Security & Malware scan by CleanTalk plugin for WordPress is vulnerable to unauthorized SQL Injection due to an authorization bypass via reverse DNS spoofing on the checkWithoutToken function in all versions up to, and including, 2.145, as well as insufficient input sanitization and validation. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00551 46th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
cleantalkLogin Security, FireWall, Malware removal by CleanTalkup to 2.145—No fix listedCNA
  • Login Security, FireWall, Malware removal by CleanTalk Vendorcleantalk Affected up to 2.145 Fixed in — No fix listed CNA

CPE names CISA-ADP · 1

CPEVersionsRoleVendor
cpe:2.3:a:cleantalk:antispam:*:*:*:*:*:wordpress:*:*——cleantalk
  • cpe:2.3:a:cleantalk:antispam:*:*:*:*:*:wordpress:*:* Versions — — ·cleantalk

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-10570
  2. 2026-10-03 Alias added: GHSA-c987-4q4r-p52g

References

Other 2

  • TI-2022-03051 Anti-Spam by CleanTalk < 5.185.1 - Admin+ SQLi CVSS 3.1HIGH 7.2
  • TI-2024-09765 Missing authorization in cleantalk Spam protection, Honeypot, Anti-Spam by CleanTalk CVSS 3.1CRITICAL 9.8
  • TI-2024-12407 Security & Malware scan by CleanTalk <= 2.149 - Unauthenticated Arbitrary File Upload CVSS 3.1CRITICAL 9.8
  • TI-2026-01186 Spam protection, Honeypot, Anti-Spam by CleanTalk <= 6.71 - Authorization Bypass via… CVSS 3.1CRITICAL 9.8
  • TI-2026-47264 WordPress Security & Malware scan by CleanTalk plugin <= 2.184 - SQL Injection vulnerability CVSS 3.1CRITICAL 9.3
  • TI-2024-09993 Spam protection, Anti-Spam, FireWall by CleanTalk <= 6.44 - Authorization Bypass due to… CVSS 3.1HIGH 8.1
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences