CVE-2026-1490

CRITICAL 9.8

Spam protection, Honeypot, Anti-Spam by CleanTalk <= 6.71 - Authorization Bypass via Reverse DNS (PTR record) Spoofing to Unauthenticated Arbitrary Plugin Installation

CVSS Score

9.8

EPSS Score

0.0%

EPSS Percentile

0th

The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due to an authorization bypass via reverse DNS (PTR record) spoofing on the 'checkWithoutToken' function in all versions up to, and including, 6.71. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated. Note: This is only exploitable on sites with an invalid API key.

CWE	CWE-350
Vendor	cleantalk
Product	spam protection, honeypot, anti-spam by cleantalk
Published	Feb 15, 2026
Last Updated	Apr 8, 2026

Stay Ahead of the Next One

Get instant alerts for cleantalk spam protection, honeypot, anti-spam by cleantalk

Be the first to know when new critical vulnerabilities affecting cleantalk spam protection, honeypot, anti-spam by cleantalk are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

cleantalk / Spam protection, Honeypot, Anti-Spam by CleanTalk

0 ≤ 6.71

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/cb603be6-4a12-49e1-b8cc-b2062eb97f16?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/cleantalk-spam-protect/trunk/lib/Cleantalk/ApbctWP/RemoteCalls.php#L69 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/cleantalk-spam-protect/trunk/lib/Cleantalk/Common/Helper.php#L64 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset/3454488/cleantalk-spam-protect#file473

Credits

Nguyen Ngoc Duc