Loading story…
A critical vulnerability in the WordPress plugin “Spam protection, Honeypot, Anti-Spam by CleanTalk” (aka CleanTalk Anti-Spam) allows unauthenticated arbitrary plugin installation in versions <= 6.71, tracked as CVE-2026-1490 with CVSS 9.8. The flaw is an authorization bypass caused by relying on reverse DNS (PTR) lookups for a security decision in the checkWithoutToken logic; attackers can spoof PTR records to impersonate trusted sources and trigger plugin installation/activation. The issue was reported by researcher Nguyen Ngoc Duc (duc193) of KCSC and published via Wordfence Intelligence; it is noted as exploitable specifically when the site is using an invalid CleanTalk API key.
Successful exploitation enables attackers to install and activate arbitrary plugins, which can be chained into remote code execution (for example, by installing another vulnerable plugin and leveraging it post-install). Separate WordPress plugin CVEs disclosed around the same time include CVE-2026-2001 (WowRevenue <= 2.1.3) enabling authenticated (subscriber+) arbitrary plugin installation via a missing capability check in Notice::install_activate_plugin, and CVE-2026-1750 (Ecwid by Lightspeed Ecommerce Shopping Cart <= 7.0.7) enabling authenticated (subscriber+) privilege escalation by supplying ec_store_admin_access during profile updates due to a missing capability check in save_custom_user_profile_fields; these are distinct issues and not part of the CleanTalk vulnerability.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
By 2026-02-17, public reporting and a Wordfence Intelligence advisory disclosed technical details for CVE-2026-1490, including that attackers could spoof PTR records to appear as cleantalk.org and install or activate arbitrary plugins. The issue was identified by Nguyen Ngoc Duc (duc193) of KCSC and was noted as potentially leading to remote code execution if an additional vulnerable or malicious plugin is installed.
On 2026-02-15, Wordfence received a report describing CVE-2026-1490, an authorization-bypass vulnerability in the WordPress plugin 'Spam protection, Honeypot, Anti-Spam by CleanTalk' affecting versions through 6.71. The flaw stems from reverse DNS (PTR record) spoofing in the checkWithoutToken function and can allow unauthenticated arbitrary plugin installation on sites using an invalid API key.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
thecyberexpress.com
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical authentication bypass in the **UpdraftPlus: WP Backup & Migration** WordPress plugin, tracked as `CVE-2026-10795`, is being actively exploited against sites running versions up to and including `1.26.4`. The flaw affects a plugin installed on more than three million WordPress sites and stems from insufficient validation in UpdraftCentral remote procedure call handling, including signature-verification weaknesses and unchecked decryption return values that can collapse to a predictable all-zero key. Wordfence reported blocking **4,987** exploitation attempts in a 24-hour period. Successful exploitation lets unauthenticated attackers impersonate the connected administrator and issue arbitrary RPC actions, including uploading and auto-activating a malicious plugin for **remote code execution** and full site compromise. The vulnerability has been classified under `CWE-347`, with a `CVSS v3.1` vector of `AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`. The issue was reportedly discovered by researcher **vtim**, and the vendor released a patch that adds stricter return-value validation; administrators are being urged to update immediately.
Jun 29, 2026
Multiple high-severity vulnerabilities were disclosed across popular **WordPress plugins**, creating pathways to account takeover, privilege escalation, and sensitive data exposure. The most severe issue, **CVE-2025-15521** in *Academy LMS* (<= `3.5.0`), allows **unauthenticated administrator account takeover** because the plugin’s password update flow relies on a **publicly exposed WordPress nonce** as authorization rather than validating user identity; *Wordfence* reported observing exploitation attempts in the wild and blocking dozens of attacks in a 24-hour period. Additional disclosures affect other plugins with different exploitation prerequisites and impacts. **CVE-2026-0726** in *Nexter Extension – Site Enhancements Toolkit* (<= `4.4.6`) is an **unauthenticated PHP object injection** via `nxt_unserialize_replace`, but it requires a usable **POP chain** from another installed plugin/theme to reach file deletion, data theft, or code execution. **CVE-2025-15347** in *Creator LMS* (<= `1.1.12`) enables **authenticated (Contributor+)** attackers to update arbitrary WordPress options due to a missing capability check, potentially leading to privilege escalation or site compromise. **CVE-2025-14977** in *Dokan* (<= `4.2.4`) is an **IDOR** in the `/wp-json/dokan/v1/settings` REST endpoint that lets **authenticated (Customer+)** users read/modify other vendors’ settings, including changing PayPal payout emails and accessing bank/payment details, enabling fraud and sensitive information disclosure.
Jun 29, 2026
Two high-severity vulnerabilities have been disclosed in widely deployed WordPress plugins, exposing internet-facing sites to **unauthenticated compromise**. `CVE-2026-3584` affects **Kali Forms** through version `2.4.9` and allows **remote code execution** because user-controlled input can be mapped into internal placeholder storage and later invoked via `call_user_func` in the `form_process` path. The issue is classified as `CWE-94` and carries a `CVSS 3.1` score with the vector `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, indicating critical impact on confidentiality, integrity, and availability. A second flaw, `CVE-2026-4038`, affects **Aimogen Pro** through version `2.7.5` and enables **unauthenticated privilege escalation** through an arbitrary function call in `aiomatic_call_ai_function_realtime` caused by a missing capability check. According to the disclosure, attackers can invoke WordPress functions such as `update_option` to change the default registration role to administrator and enable user registration, effectively creating a path to full site takeover. The vulnerability is tracked as `CWE-862` and was likewise rated with a high-impact `CVSS 3.1` vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`.
Jun 29, 2026