CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in СleanTalk - Anti-Spam Protection Spam protection, Anti-Spam, FireWall by CleanTalk.This issue affects Spam protection, Anti-Spam, FireWall by CleanTalk: from n/a through 6.20.
Explanation of Vulnerability in Simple Terms
CleanTalk Anti-Spam Protection versions up to 6.20 contain a cross-site request forgery (CSRF) vulnerability. An attacker can craft a malicious link or page that, when visited by a logged-in site administrator, performs unwanted actions within the plugin's settings. The vulnerability requires user interaction and does not expose sensitive data, but can modify plugin configuration.
What an attacker can do
Trick a site admin into visiting a malicious page that changes the plugin's settings without their knowledge.
Potential impact on your site
Plugin settings could be altered by an attacker without your consent, potentially disabling spam protection or changing security rules.
Conditions required to exploit
Site admin must be logged in and click a malicious link or visit an attacker-controlled page.
Key dates
External resources
Related vulnerabilities
