CVE-2024-10542: Spam protection, Anti-Spam, FireWall by CleanTalk <= 6.43.2 - Authorization Bypass via Reverse DNS Spoofing to Unauthenticated Arbitrary Plugin Installation
The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due to an authorization bypass via reverse DNS spoofing on the checkWithoutToken function in all versions up to, and including, 6.43.2. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10542?
CVE-2024-10542 is classified as a high severity vulnerability due to the potential for unauthorized arbitrary plugin installation.
How do I fix CVE-2024-10542?
To fix CVE-2024-10542, update the CleanTalk Spam protection, Anti-Spam, FireWall plugin to the latest version beyond 6.43.2.
What causes CVE-2024-10542?
CVE-2024-10542 is caused by an authorization bypass vulnerability through reverse DNS spoofing in the checkWithoutToken function.
Who is affected by CVE-2024-10542?
All users of the CleanTalk Spam protection, Anti-Spam, FireWall plugin for WordPress up to and including version 6.43.2 are affected by CVE-2024-10542.
What is the impact of CVE-2024-10542?
The impact of CVE-2024-10542 includes the risk of unauthorized access and installation of malicious plugins on affected WordPress sites.