VDB

CVE-2024-10781

CVE-2024-10781 PUBLISHED CVSS 8.100000381469727 HIGH

The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due to an missing empty value check on the 'api_key' value in the 'perform' function in all versions up to, and including, 6.44. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated.

EPSS 2.51% · 85.6th percentile

Risk Scores

CVSS v3.1
8.100000381469727
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
2.51%
85.6th percentile

Affected Products

VendorProductVersions
cleantalkantispam0, 0
cleantalkSpam protection, Honeypot, Anti-Spam by CleanTalk0
cleantalkSpam protection, Anti-Spam, FireWall by CleanTalk*
cleantalkspam_protection\,_antispam\,_firewall0, 0, 0

Timeline

  • Nov 26, 2024 CVE Published
  • Nov 26, 2024 PoC Published
  • Nov 26, 2024 PoC Published
  • Nov 26, 2024 PoC Published
  • Nov 26, 2024 PoC Published
  • Nov 27, 2024 EPSS Score
  • Nov 27, 2024 PoC Published
  • Nov 27, 2024 PoC Published
  • Dec 2, 2024 Coalition ESS Score
  • Jan 1, 2025 EPSS Score
  • Jan 18, 2025 EPSS Score
  • Feb 22, 2025 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›