PT-2026-20298 · WordPress · Dam Spam

Webguyio · Publicado 2026-02-18 · Atualizado 2026-02-18 · CVE-2026-2112

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Dam Spam plugin for WordPress versions up to and including 1.0.8

Description The Dam Spam plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF). This is caused by a lack of nonce verification during the deletion of pending comments on the cleanup page. An unauthenticated attacker could potentially delete all pending comments by tricking an administrator into performing an action, such as clicking a malicious link.

Recommendations Update the Dam Spam plugin to a version newer than 1.0.8.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2026-2112

Produtos afetados

Dam Spam

Referências · 9

• https://github.com/webguyio/dam-spam/blob/52e12fb455e7b670af2e0713f9da84d2d1d309ac/settings/cleanup.php#L92 · Nota
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3457369%40dam-spam&new=3457369%40dam-spam&sfp_email=&sfph_mail= · Nota
• https://twitter.com/CVEnew/status/2024038162381598851 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2024153939399078072 · Publicação no Twitter
• https://t.me/CVEtracker/44954 · Publicação no Telegram
• https://plugins.trac.wordpress.org/browser/dam-spam/tags/1.0.6/settings/cleanup.php#L92 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-2112 · Nota de Segurança
• https://wordfence.com/threat-intel/vulnerabilities/id/e336dc27-4a76-4197-929c-b221f42bfe69?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/dam-spam/trunk/settings/cleanup.php#L92 · Nota