← Back

CVE-2024-10781

nvd nist
Published: Nov 26, 2024Modified: Jul 12, 2025

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Exploitability: 3.9 / Impact: 3.6
Source: NVD

Description

The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due to an missing empty value check on the 'api_key' value in the 'perform' function in all versions up to, and including, 6.44. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated.

Affected (1)

Cleantalk
1 product
Spam Protection, Antispam, Firewall
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Spam Protection, Antispam, Firewall
Before 6.45

Related CWEs

CWE-703
Improper Check or Handling of Exceptional Conditions
The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.

References (4)

Source: security@wordfence.com
Product
Source: security@wordfence.com
Product
Source: security@wordfence.com
Patch
Source: security@wordfence.com
Third Party Advisory

Timeline

No history available yet.