CVE-2026-1490

CRITICAL

CleanTalk Spam Protection <= 6.71 - Unauthenticated Arbitrary Plugin Installation via DNS Spoofing

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2026-1490. PoCs published by XiaomingX, comthompson30.

AI-analyzed exploit summary The repository contains a functional SQL injection exploit for WordPress Quiz Maker (CVE-2025-10042), demonstrating time-based blind SQLi via crafted HTTP headers. The PoC includes data extraction logic for admin credentials and hashes.

Description

The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due to an authorization bypass via reverse DNS (PTR record) spoofing on the 'checkWithoutToken' function in all versions up to, and including, 6.71. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated. Note: This is only exploitable on sites with an invalid API key.

Exploits (2)

github WORKING POC 10 stars
by XiaomingX · pythonpoc
https://github.com/XiaomingX/data-cve-poc-py-v1/tree/main/2026/CVE-2026-1490

The repository contains a functional SQL injection exploit for WordPress Quiz Maker (CVE-2025-10042), demonstrating time-based blind SQLi via crafted HTTP headers. The PoC includes data extraction logic for admin credentials and hashes.

Classification
Working Poc 95%
Attack Type
Sqli
Complexity
Moderate
Reliability
Reliable
Target: WordPress Quiz Maker <= 6.7.0.56
No auth needed
Prerequisites: target WordPress URL · path to quiz page · vulnerable header (default: X-Forwarded-For)
devstral-2 · analyzed Feb 27, 2026 Full analysis →
nomisec SUSPICIOUS 2 stars
by comthompson30 · poc
https://github.com/comthompson30/CVE-2026-1490

The repository lacks actual exploit code and instead redirects users to an external download link (tinyurl.com). The README provides minimal technical details and reads like a sales pitch rather than a legitimate technical analysis.

Classification
Suspicious 95%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Theoretical
Target: CleanTalk's Spam Protection, Anti-Spam, FireWall plugin for WordPress (versions up to and including 6.71)
No auth needed
Prerequisites: Invalid API key · Reverse DNS (PTR record) spoofing capability
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4

Scores

CVSS v3 9.8
EPSS 0.0005
EPSS Percentile 15.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-350
Status published
Products (1)
cleantalk/Spam protection, Honeypot, Anti-Spam by CleanTalk < 6.71
Published Feb 15, 2026
Tracked Since Feb 18, 2026