by Kastro
Paper/Archive/CVE-2024-10542

CVE-2024-10542

cleantalk Spam protection, Honeypot, Anti-Spam by CleanTalk — Spam protection, Anti-Spam, FireWall by CleanTalk <= 6.43.2 - Authorization Bypass via Reverse DNS Spoofing to Unauthenticated Arbitrary Plugin Installation

EPSS 15%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 96.8.968 × 2019.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due to an authorization bypass via reverse DNS spoofing on the checkWithoutToken function in all versions up to, and including, 6.43.2. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated.

Affected

ProductAffectedFixed inSource
Spam protection, Honeypot, Anti-Spam by CleanTalk≤ 6.43.2–CNA
antispam≤ 6.43.2–CISA-ADP

Scores by source

Wordfence (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refwordfence.com/threat-intel/vulnerabilities/id/d7eb5fad-bb62-4f0b-ad52-b16c3e442b62?source=cverefplugins.trac.wordpress.org/browser/cleantalk-spam-protect/tags/6.43.2/lib/Cleantalk/ApbctWP/RemoteCalls.php#L41refplugins.trac.wordpress.org/changeset/3179819/cleantalk-spam-protect#file631