VDB
CVE-2024-10781
CVE-2024-10781
PUBLISHED
CVSS 8.1 HIGH
Reported by Wordfence · Published November 26, 2024
The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due to an missing empty value check on the 'api_key' value in the 'perform' function in all versions up to, and including, 6.44. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated.
Risk Scores
CVSS 3.1
8.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| cleantalk | Spam protection, Honeypot, Anti-Spam by CleanTalk | 0 |
| cleantalk | Spam protection, Honeypot, Anti-Spam by CleanTalk | 0 |
| cleantalk | antispam | 0 |
Timeline
- Nov 26, 2024 VulnCheck KEV Exploitation
- Nov 26, 2024 CVE Published
- Nov 26, 2024 PoC Published
- Nov 26, 2024 CVE Updated
- Nov 26, 2024 PoC Published
- Nov 26, 2024 PoC Published
- Nov 26, 2024 PoC Published
- Nov 27, 2024 EPSS Score
- Nov 27, 2024 PoC Published
- Nov 27, 2024 PoC Published
- Dec 2, 2024 Coalition ESS Score
- Jan 2, 2025 EPSS Score