CVE-2026-19855: Spam protection, Honeypot, Anti-Spam by CleanTalk < 6.87 - Unauthenticated Arbitrary Shortcode Execution via Comment Text
The CleanTalk WordPress plugin before 6.87 does not prevent unauthenticated, user-supplied comment content from being passed to WordPress's shortcode engine, allowing any visitor to have arbitrary shortcodes registered on the site executed server-side and rendered to every subsequent visitor of the page.
Affected Software
Event History
Frequently Asked Questions
Which sites are exposed to exploitation?
Sites using the affected CleanTalk WordPress plugin version before 6.87 are exposed if visitors can submit comment content that reaches WordPress's shortcode engine. No authentication or user interaction is required from the attacker.
What must an attacker do to trigger the issue?
An attacker only needs to submit crafted comment text containing a shortcode that is registered on the site. The shortcode is executed server-side and its output is rendered when later visitors view the affected page.
What is the immediate mitigation?
Update the CleanTalk plugin to version 6.87 or later. If updating cannot occur immediately, prevent untrusted visitors from submitting comments or otherwise ensure comment content cannot be processed by the WordPress shortcode engine.
How can I tell whether a site may already be affected?
Review comments submitted while the plugin was below 6.87 for shortcode-like content, particularly comments on pages viewed by other visitors. Also identify which shortcodes are registered on the site, since those are the functions an attacker could cause to execute through crafted comments.