PT-2026-8222 · WordPress · Cleantalk

Duc193 + 1 · Publicado 2026-02-15 · Atualizado 2026-02-26 · CVE-2026-1490

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CleanTalk versions up to and including 6.71

Description The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress has a flaw that allows unauthorized Arbitrary Plugin Installation. This is due to an authorization bypass via reverse DNS (PTR record) spoofing within the checkWithoutToken function. Unauthenticated attackers can install and activate arbitrary plugins, potentially leading to remote code execution if another vulnerable plugin is already installed and active. This is exploitable on sites with an invalid API key. Approximately 200,000 sites are potentially affected.

Recommendations Update to version 6.72 or later.

Correção

RCE

Enumeração de Fraquezas

CWE-350

Identificadores relacionados

CVE-2026-1490

Produtos afetados

Cleantalk

Referências · 20

• https://twitter.com/VolerionSec/status/2022888482322911349 · Publicação no Twitter
• https://twitter.com/offseq/status/2023208249890054491 · Publicação no Twitter
• https://t.me/cveNotify/152049 · Publicação no Telegram
• https://twitter.com/TweetThreatNews/status/2023824794949423142 · Publicação no Twitter
• https://twitter.com/threatcluster/status/2023442369702465971 · Publicação no Twitter
• https://wordfence.com/threat-intel/vulnerabilities/id/cb603be6-4a12-49e1-b8cc-b2062eb97f16?source=cve · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-1490 · Nota de Segurança
• https://twitter.com/0dayPublishing/status/2023155789230145627 · Publicação no Twitter
• https://plugins.trac.wordpress.org/changeset/3454488/cleantalk-spam-protect#file473 · Nota
• https://t.me/netlas/538 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2022892441276182905 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/cleantalk-spam-protect/trunk/lib/Cleantalk/Common/Helper.php#L64 · Nota
• https://twitter.com/CVEarity/status/2023014800138416153 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2023567346712121450 · Publicação no Twitter
• https://t.me/CVEtracker/44747 · Publicação no Telegram