WordPress CVEs

Description

The Security & Malware scan by CleanTalk plugin for WordPress is vulnerable to unauthorized SQL Injection due to an authorization bypass via reverse DNS spoofing on the checkWithoutToken function in all versions up to, and including, 2.145, as well as insufficient input sanitization and validation. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Affected WordPress components

• Security Plugin, Firewall & Malware Scanner with Auto Removal Plugin · security-malware-firewall
  Confirmed match Active
  Up to and including 2.145
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• cleantalk Login Security, FireWall, Malware removal by CleanTalk — Up to and including 2.145
• cleantalk antispam — Up to and including 2.145

References

• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/security-malware-firewall/tags/2.145/lib/CleantalkSP/Common/RemoteCalls.php#L59
• www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/2187311d-6651-4eca-806d-aa2ff9fae4e2?source=cve
• nvd.nist.gov Official NVD record