DNS
CVE-2026-1490
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSpoof reverse DNS PTR record
-
DeliveryCall checkWithoutToken function without authentication
-
ExploitBypass authorization checks
-
ExecutionInstall arbitrary WordPress plugin
-
ImpactExecute remote code via plugin
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication DNS-independent verification
|
| Exploitation Conditions | WordPress site running CleanTalk plugin versions ≤6.71 with invalid or missing API key configured, allowing unauthenticated access to the checkWithoutToken function via reverse DNS spoofing |
| Impact | CVSS 9.8 — CleanTalk is one of the most popular WordPress anti-spam plugins. DNS-based authorization is trivially bypassable. |
| Exploit ScenarioDerived | An attacker spoofs reverse DNS to impersonate a CleanTalk server, bypassing authorization checks and performing file operations on the WordPress installation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
CleanTalk Anti-Spam WordPress plugin has an authorization bypass enabling unauthenticated attackers to perform file operations on the WordPress server.
Earlier versions of this analysis (1)
Authorization bypass in CleanTalk Anti-Spam enables unauthenticated file operations.
RemediationAI
Update the plugin. Implement token-based authorization instead of DNS-based.
Affected ProductsAI
Spam protection, Anti-Spam, FireWall by CleanTalk
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The CleanTalk Anti-Spam/FireWall plugin has a CWE-350 reliance on reverse DNS for authorization, which can be spoofed to bypass access controls.
Know when DNS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due to an authorization bypass via reverse DNS (PTR record) spoofing on the 'checkWithoutToken' function in all versions up to, and including, 6.71. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated. Note: This is only exploitable on sites with an invalid API key.
Articles & Coverage 1
Executive ViewAI
WordPress sites using the CleanTalk anti-spam plugin (versions up to 6.71) face critical risk of unauthorized plugin installation through DNS spoofing attacks, allowing attackers to bypass security controls and gain administrative access. This vulnerability affects any organization relying on this plugin for security and could lead to complete website compromise, data theft, and malware distribution.
Disable the CleanTalk plugin immediately; implement Web Application Firewall (WAF) rules to block requests to wp-admin/plugin-install.php from unexpected sources; enforce strict DNS validation and implement reverse DNS lookup verification at network perimeter; restrict plugin installation capabilities to administrative accounts only; deploy file integrity monitoring on wp-content/plugins directory; implement network segmentation to limit lateral movement if compromise occurs; enable comprehensive logging and alerting on all plugin-related activities.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Sandbox escape in Kata Containers allowing guest VM to access host resources. CVSS 10.0 — undermines the core security g
Buffer overflow in Ayukov NFTP client 1.71 in SYST command handling allows remote FTP servers to execute arbitrary code
Buffer overflow in Prime95 29.8 build 6 user ID field allows code execution. PoC available.
Stack overflow in Domain Quester Pro 6.02 via SEH overwrite. PoC available.
Cyberoam Authentication Client 2.1.2.7 has a buffer overflow allowing remote attackers to execute code through the netwo
Kingdia CD Extractor 3.0.2 has a buffer overflow in the registration name field. PoC available.
Ether MP3 CD Burner 1.3.8 has buffer overflow in registration enabling bind shell on port 3110 via SEH overwrite. PoC av
Buffer overflow in WMV to AVI MPEG DVD Convertor 4.6.1217 allows code execution via crafted media files. PoC available.
Stack-based buffer overflow in Nsauditor Network Auditing Tool 3.0.28 and 3.2.1.0 in the DNS Lookup tool allows attacker
Stack-based buffer overflow in Tenda RX3 firmware 16.03.13.11 allows authenticated remote attackers to achieve full syst
Remote code execution in Tenda F453 1.0.0.3 DNS firmware via a buffer overflow in the /goform/SetIpBind endpoint allows
AVS Audio Converter 9.1.2.600 contains a stack overflow vulnerability that allows attackers to execute arbitrary code by
GitHub PoC
Exploit-DB