CVE-2021-24295

The Spam protection, Honeypot, Anti-Spam by CleanTalk plugin before version 5.153.4 contained an unauthenticated time-based blind SQL injection flaw in the update_log function located in lib/Cleantalk/ApbctWP/Firewall/SFW.php. An attacker could exploit this vulnerability by first obtaining a ct_sfw_pass_key cookie through an initial request, then manually setting a ct_sfw_passed cookie while preventing it from being reset, and finally injecting malicious SQL through the User-Agent header to execute arbitrary queries. The vulnerability required no authentication and could allow an attacker to extract or manipulate sensitive database information.

Based on public CVE data (MITRE/NVD).