PT-2026-20298 · WordPress · Dam Spam

Webguyio · Published 2026-02-18 · Updated 2026-02-18 · CVE-2026-2112

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Dam Spam plugin for WordPress versions up to and including 1.0.8

Description The Dam Spam plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF). This is caused by a lack of nonce verification during the deletion of pending comments on the cleanup page. An unauthenticated attacker could potentially delete all pending comments by tricking an administrator into performing an action, such as clicking a malicious link.

Recommendations Update the Dam Spam plugin to a version newer than 1.0.8.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-2112

Affected Products

Dam Spam

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-2112 · Security Note
• https://github.com/webguyio/dam-spam/blob/52e12fb455e7b670af2e0713f9da84d2d1d309ac/settings/cleanup.php#L92 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3457369%40dam-spam&new=3457369%40dam-spam&sfp_email=&sfph_mail= · Note
• https://twitter.com/CVEnew/status/2024038162381598851 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2024153939399078072 · Twitter Post
• https://t.me/CVEtracker/44954 · Telegram Post
• https://plugins.trac.wordpress.org/browser/dam-spam/tags/1.0.6/settings/cleanup.php#L92 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/e336dc27-4a76-4197-929c-b221f42bfe69?source=cve · Note
• https://plugins.trac.wordpress.org/browser/dam-spam/trunk/settings/cleanup.php#L92 · Note