CVE-2024-10781

HIGH EXPLOITED

Cleantalk Spam Protection, Antispam, Firewall - Remote Code Execution

Title source: rule

Description

The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due to an missing empty value check on the 'api_key' value in the 'perform' function in all versions up to, and including, 6.44. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated.

References (4)

[Product] https://plugins.trac.wordpress.org/browser/cleantalk-spam-protect/tags/6.44/lib/Cleantalk/ApbctWP/RemoteCalls.php#L95

[Product] https://plugins.trac.wordpress.org/browser/cleantalk-spam-protect/tags/6.44/lib/Cleantalk/ApbctWP/RemoteCalls.php#L96

[Patch] https://plugins.trac.wordpress.org/changeset/3188546/cleantalk-spam-protect#file653

[Third Party Advisory] https://www.wordfence.com/threat-intel/vulnerabilities/id/79ae062c-b084-4045-9407-2d94919993af?source=cve

Scores

CVSS v3 8.1

EPSS 0.0251

EPSS Percentile 85.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

VulnCheck KEV 2024-11-26

CWE

CWE-703

Status published

Products (2)

cleantalk/Spam protection, Honeypot, Anti-Spam by CleanTalk < 6.44

cleantalk/spam_protection\,_antispam\,_firewall < 6.45

Published Nov 26, 2024

Tracked Since Feb 18, 2026