CleanTalk WordPress Plugin Unauthenticated Arbitrary Plugin Installation Vulnerability

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Name: - Spam protection, Anti-Spam, FireWall by CleanTalk <= 6.44 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Arbitrary Plugin Installation 2. Vulnerability Type: - Improper Check or Handling of Exceptional Conditions 3. CVSS Score: - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS:8.1 (High) 4. Public Release Date: - November 25, 2024 5. Update Date: - November 26, 2024 6. Researcher: - István Márton - Wordfence 7. Vulnerability Description: - Describes an unauthenticated arbitrary plugin installation vulnerability in the Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress, caused by a missing empty value check for the parameter in the function. This allows unauthorized attackers to install and activate any plugin, enabling remote code execution, provided another vulnerable plugin is already installed and activated. 8. Reference Links: - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org 9. Remediation Recommendation: - Upgrade to version 6.45 or later, which contains the fix. 10. Copyright and Licensing Information: - Copyright and licensing information is provided by Defiant Inc. and MITRE Corporation. 11. Vulnerability Database: - The Wordfence Intelligence WordPress vulnerability database is free and accessible via API for querying. This information helps users understand the vulnerability in detail, including its severity, scope of impact, and how to remediate it.

Goal Reached Thanks to every supporter — we hit 100%!

CleanTalk WordPress Plugin Unauthenticated Arbitrary Plugin Installation Vulnerability

More from this source