PT-2024-8881 · WordPress · Spam Protection

István Márton · Published 2024-11-01 · Updated 2025-07-12 · CVE-2024-10781

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Spam protection, Anti-Spam, FireWall by CleanTalk for WordPress versions up to and including 6.44

Description: The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is susceptible to unauthorized arbitrary plugin installation. This issue stems from a missing validation of the api key value within the perform function. This allows unauthenticated attackers to install and activate arbitrary plugins, potentially leading to remote code execution if another vulnerable plugin is present. The vulnerability is related to incorrect handling of exceptional states.

Recommendations: Spam protection, Anti-Spam, FireWall by CleanTalk for WordPress version 6.44 and earlier: Update to a version beyond 6.44 to address the missing empty value check in the perform function.

Fix

RCE

Weakness Enumeration

CWE-703

Related Identifiers

BDU:2024-10548

CVE-2024-10781

Affected Products

Spam Protection

References · 35

• https://osv.dev/vulnerability/CVE-2024-10781 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset/3188546/cleantalk-spam-protect#file653 · Patch
• https://bdu.fstec.ru/vul/2024-10548 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-10781 · Security Note
• https://t.me/latest_high_impact_cve/1567 · Telegram Post
• https://twitter.com/cracbot/status/1863100847468822657 · Twitter Post
• https://twitter.com/Dinosn/status/1861261693147361736 · Twitter Post
• https://plugins.trac.wordpress.org/browser/cleantalk-spam-protect/tags/6.44/lib/Cleantalk/ApbctWP/RemoteCalls.php#L96 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/79ae062c-b084-4045-9407-2d94919993af?source=cve · Note
• https://twitter.com/zoomeye_team/status/1861357359312052270 · Twitter Post
• https://twitter.com/testalways/status/1861372742097858579 · Twitter Post
• https://t.me/true_secator/6476 · Telegram Post
• https://twitter.com/CVEnew/status/1861286371106668795 · Twitter Post
• https://twitter.com/CriminalIP_US/status/1867464476817338560 · Twitter Post
• https://twitter.com/vietthanhsports/status/1862016058233954642 · Twitter Post