Back to overview

CVE-2026-1490

CRITICAL
9.8
CVSS 3.1
Description
The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due to an authorization bypass via reverse DNS (PTR record) spoofing on the 'checkWithoutToken' function in all versions up to, and including, 6.71. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated. Note: This is only exploitable on sites with an invalid API key.

Metadata

CVE ID
CVE-2026-1490
State
PUBLISHED
Assigner
Wordfence
Reserved
2026-01-27 14:18 UTC
Published
2026-02-15 02:22 UTC
Last updated
2026-04-08 17:23 UTC
Primary CWE
CWE-350
CWE-350 Reliance on Reverse DNS Resolution for a Security-Cr…
Vendor / Product
cleantalk / Spam protection, Honeypot, Anti-Spam by CleanTalk
Sources
cve.org  ·  NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
none
Automatable
yes
Tech. Impact
total
Affected products (1)
VendorProductPlatformVersions
cleantalk Spam protection, Honeypot, Anti-Spam by CleanTalk — 0 ≤ 6.71
Weakness (CWE)
CWESourceDescription
CWE-350 cna CWE-350 Reliance on Reverse DNS Resolution for a Security-Critical Action
CVSS scores (1)
ScoreSeverityVersionSourceVector
9.8 CRITICAL 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References (4)
Back to overview