CVE-2026-1490 - Vulnerability Analysis
CriticalCVSS: 9.8Last Updated: February 15, 2026
CleanTalk Spam protection, Anti-Spam, FireWall - Authorization Bypass
Overview
CleanTalk Spam protection, Anti-Spam, FireWall WordPress plugin <= 6.71 contains an authorization bypass via reverse DNS spoofing in 'checkWithoutToken', letting unauthenticated attackers install arbitrary plugins, exploit requires invalid API key.
Severity & Score
Impact
Unauthenticated attackers can install and activate arbitrary plugins, potentially leading to remote code execution if other vulnerable plugins exist.
Mitigation
Update to the latest version beyond 6.71.
References
- https://plugins.trac.wordpress.org/browser/cleantalk-spam-protect/trunk/lib/Cleantalk/ApbctWP/RemoteCalls.php#L69
- https://plugins.trac.wordpress.org/browser/cleantalk-spam-protect/trunk/lib/Cleantalk/Common/Helper.php#L64
- https://plugins.trac.wordpress.org/changeset/3454488/cleantalk-spam-protect#file473
- https://www.wordfence.com/threat-intel/vulnerabilities/id/cb603be6-4a12-49e1-b8cc-b2062eb97f16?source=cve
Social Media Activity(3 posts)
Critical Vulnerability in CleanTalk WordPress Plugin Puts 200,000 Sites at Risk A recently discovered critical vulnerability (CVE-2026-1490, CVSS 9.8) in the CleanTalk WordPress plugin, affecting versions up to 6.71, has raised alarms for the cybersecurity community. This flaw exposes over 200,000 websites to severe threats, allowing unauthenticated attackers to exploit the vulnerability. The attackers could potentially install malicious plugins and execute remote code… https://undercodenews.com/critical-vulnerability-in-cleantalk-wordpress-plugin-puts-200000-sites-at-risk/
View original post
Critical CleanTalk Plugin Vulnerability Allows WordPress Site Takeover via DNS Spoofing A critical vulnerability in the CleanTalk WordPress plugin (CVE-2026-1490) allows unauthenticated attackers to bypass authorization via Reverse DNS spoofing and install arbitrary plugins, leading to full site takeover. **If you are using ""Spam protection, Anti-Spam, FireWall by CleanTalk", update ASAP. Never rely on DNS records for authentication because they are easily spoofed by attackers.** #cybersecurity #infosec #advisory #vulnerability https://beyondmachines.net/event_details/critical-cleantalk-plugin-vulnerability-allows-wordpress-site-takeover-via-dns-spoofing-v-h-r-b-n/gD2P6Ple2L
View original post
🔴 CVE-2026-1490 - Critical (9.8) The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due to an authorization bypass via reverse DNS (PTR record) spoofing on the 'checkWithoutToken' function in all ... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1490/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
View original postGitHub Repositories(1 repo)
Related Resources
Details
- CVE ID
- CVE-2026-1490
- Severity
- Critical
- CVSS Score
- 9.8
- Type
- broken_access_control
- Status
- new
- EPSS
- 8.4%
- Social Posts
- 3
CWE
- CWE-350
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H