CVE-2024-10781

HIGH EXPLOITED

CleanTalk Spam Protection <= 6.44 - Unauthenticated Arbitrary Plugin Installation

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2024-10781 has been observed exploited in the wild (reported by VulnCheck KEV).

Description

The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due to an missing empty value check on the 'api_key' value in the 'perform' function in all versions up to, and including, 6.44. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated.

References (4)

Core 4

Scores

CVSS v3 8.1
EPSS 0.0382
EPSS Percentile 88.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

VulnCheck KEV 2024-11-26
CWE
CWE-703
Status published
Products (2)
cleantalk/Spam protection, Honeypot, Anti-Spam by CleanTalk < 6.44
cleantalk/spam_protection\,_antispam\,_firewall < 6.45
Published Nov 26, 2024
Tracked Since Feb 18, 2026