Now officially on WordPress.org

CVE Database / CVE-2024-10781

CVE · High

CVE-2024-10781 — Spam protection, Honeypot, Anti-Spam by CleanTalk [cleantalk-spam-protect] < 6.45

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2024-10781 Spam protection, Honeypot, Anti-Spam by CleanTalk [cleantalk-spam-protect] < 6.45 Improper Check or Handling of Exceptional Conditions High 8.1 < 6.45 6.45 2024-11-25 —

CVE-2024-10781

The CleanTalk spam protection plugin for WordPress versions up to 6.44 contains a vulnerability where the perform function fails to validate whether the api_key parameter is empty. This flaw allows unauthenticated attackers to install and activate arbitrary plugins without proper authorization. If a separately vulnerable plugin is present on the site, an attacker could exploit this chain of vulnerabilities to execute arbitrary code on the affected WordPress installation.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings