A series of critical vulnerabilities were identified in the popular WordPress plugin Spam protection, Anti-Spam, FireWall. These vulnerabilities could potentially lead to remote code execution on affected websites. The plugin developers have since released patches to address these flaws, and it is imperative for WordPress users to update their websites with the latest plugin version as soon as possible.
Multiple Vulnerabilities Discovered in Anti-Spam WordPress Plugin
Recent findings from Wordfence have revealed that several critical vulnerabilities in the Spam protection, Anti-Spam, FireWall by CleanTalk WordPress plugin have been successfully fixed.
Two specific vulnerabilities were identified, posing significant risks to websites using the plugin:
- CVE-2024-10542 (CVSS 9.8): This vulnerability allowed unauthorized plugin installations by bypassing authorization. Attackers could exploit this flaw to gain code execution privileges, especially in conjunction with other vulnerable plugins.
- CVE-2024-10781 (CVSS 8.1): Another authorization bypass vulnerability was discovered due to a missing check on the ‘api_key’ value. This flaw could enable unauthenticated attackers to install arbitrary plugins and execute remote code.
Wordfence provided in-depth technical analyses of these vulnerabilities in their report.
The vulnerabilities were first identified by security researcher Michael Mazzolini, who reported CVE-2024-10542 through Wordfence’s bug bounty program and received a $4095 bounty. Subsequently, Wordfence uncovered CVE-2024-10781 and collaborated with the plugin developers to release patches for both vulnerabilities.
The plugin, with over 200,000 active installations, poses a significant risk to websites. Therefore, all WordPress administrators using this plugin are strongly advised to update to the latest version (6.45.2 as of now) to ensure the security of their websites.
Share your thoughts in the comments section below.
