Two important safety flaws impacting the Spam safety, Anti-Spam, and FireWall plugin WordPress may enable an unauthenticated attacker to put in and allow malicious plugins on prone websites and probably obtain distant code execution.
The vulnerabilities, tracked as CVE-2024-10542 and CVE-2024-10781, carry a CVSS rating of 9.8 out of a most of 10.0. They had been addressed in variations 6.44 and 6.45 launched this month.
Put in on over 200,000 WordPress websites, CleanTalk’s Spam safety, Anti-Spam, FireWall plugin is advertised as a “common anti-spam plugin” that blocks spam feedback, registrations, surveys, and extra.
In line with Wordfence, each vulnerabilities concern an authorization bypass difficulty that would enable a malicious actor to put in and activate arbitrary plugins. This might then pave the way in which for distant code execution if the activated plugin is susceptible of its personal.
The plugin is “susceptible to unauthorized Arbitrary Plugin Set up attributable to a lacking empty worth test on the ‘api_key’ worth within the ‘carry out’ operate in all variations as much as, and together with, 6.44,” safety researcher István Márton said, referring to CVE-2024-10781.
However, CVE-2024-10542 stems from an authorization bypass by way of reverse DNS spoofing on the checkWithoutToken() operate.
Whatever the bypass methodology, profitable exploitation of the 2 shortcomings may enable an attacker to put in, activate, deactivate, and even uninstall plugins.
Customers of the plugin are suggested to make sure that their websites are up to date to the newest patched model to safeguard in opposition to potential threats.
The event comes as Sucuri has warned of multiple campaigns which might be leveraging compromised WordPress websites to inject malicious code chargeable for redirecting site visitors to different websites by way of bogus adverts, skimming login credentials, in addition to drop malware that captures admin passwords, redirects to VexTrio Viper rip-off websites, and execute arbitrary PHP code on the server.
