• Posted by: Michael Johnson
• November 27, 2024

Critical WordPress Plugin Flaws Allow Remote Code Execution

Two critical security vulnerabilities affecting the Spam Protection, Anti-Spam, and FireWall plugin for WordPress could enable unauthenticated attackers to install and activate malicious plugins on vulnerable websites, potentially leading to remote code execution (RCE).

Vulnerabilities Overview

The flaws, identified as CVE-2024-10542 and CVE-2024-10781, both carry a CVSS score of 9.8, signaling their severity. Fixes for these vulnerabilities were included in plugin versions 6.44 and 6.45, released this month.

CleanTalk's plugin, installed on over 200,000 WordPress sites, is marketed as a universal solution to block spam in comments, registrations, surveys, and more.

Details of the Flaws

1. CVE-2024-10781
   This issue is caused by a missing value check in the ‘api_key’ field within the plugin’s perform function. This flaw allows unauthorized arbitrary plugin installation and activation across versions up to and including 6.44.

Security researcher István Márton noted that this could open the door for attackers to exploit vulnerable plugins further.

2. CVE-2024-10542
   This vulnerability leverages reverse DNS spoofing in the checkWithoutToken() function, allowing an attacker to bypass authorization protocols.

Regardless of the method exploited, attackers can install, activate, deactivate, or uninstall plugins, potentially gaining full control of a site.

User Advisory

Website administrators using the plugin are urged to update to the latest patched version to safeguard against these serious threats. Failure to update leaves sites exposed to exploitation, including unauthorized access and malware installation.

Related Threats

This discovery coincides with warnings from Sucuri, highlighting multiple campaigns targeting compromised WordPress sites. These attacks aim to:

1. Inject malicious code to redirect visitors to scam sites.
2. Steal login credentials.
3. Drop malware to capture admin passwords.
4. Redirect to fraudulent sites like VexTrio Viper.
5. Execute arbitrary PHP code on affected servers.

Regular updates and monitoring are critical to maintaining a secure WordPress environment.