Critical Flaws in WordPress Anti-Spam Plugin Expose 200K Sites

Two critical security vulnerabilities in the WordPress anti-spam plugin CleanTalk, which provides Spam protection, Anti-Spam, and Firewall functions, could allow unauthenticated attackers to install and activate malicious plugins on vulnerable sites, potentially leading to remote code execution, reported The Hacker News.

Tracked as CVE-2024-10542 and CVE-2024-10781, these flaws have a severity rating of 9.8 out of 10. They were fixed in versions 6.44 and 6.45, released this month.

CleanTalk’s plugin, installed on over 200,000 WordPress sites, is marketed as an all-in-one anti-spam solution that blocks unwanted comments, registrations, surveys, and more.

via GIPHY

According to Wordfence, both vulnerabilities are due to an authorization bypass that could let attackers install and activate arbitrary plugins. If the activated plugin contains its own vulnerabilities, it could lead to remote code execution.

You Won’t Need Any Extra Security Plugins With Cloudways!

Cloudways’ built-in Malware Protection Add-on shields your site from threats without the need for extra plugins. Focus on growing your business, not troubleshooting security.

Try For Free

CVE-2024-10781 arises from a missing empty value check on the ‘api_key’ parameter in the ‘perform’ function, present in all versions up to 6.44, making it possible to install unauthorized plugins. CVE-2024-10542, on the other hand, involves an authorization bypass via reverse DNS spoofing in the checkWithoutToken() function.

Exploiting either of these vulnerabilities allows attackers to install, activate, deactivate, or uninstall plugins on affected sites.

7 Best WordPress Anti-Malware Plugins to Combat Security Threats

Users of the CleanTalk plugin are urged to update to the latest version to protect their sites from potential attacks.

This warning comes amid reports from Sucuri about ongoing campaigns targeting compromised WordPress sites, which inject malicious code to redirect visitors, steal login credentials, drop malware, and exploit admin passwords, among other threats.