Security Flaw Hits CleanTalk Plugin

A critical security flaw has been discovered in the CleanTalk anti-spam plugin for WordPress, potentially placing up to 200,000 websites at serious risk. The vulnerability could allow attackers to carry out remote code execution without needing to log in, giving them the ability to control parts of affected websites.

Security specialists have rated the issue with a severity score of 9.8 out of 10, classifying it as critical. The flaw impacts CleanTalk plugin versions up to and including version 6.71. With hundreds of thousands of WordPress sites relying on this plugin for protection against spam and malicious activity, the scale of the threat is significant.

The vulnerability allows unauthorised users to install harmful or modified plugins on vulnerable websites. Once these plugins are in place, attackers can use them to run malicious commands, steal sensitive data, deface websites, or even gain full administrative control.

 

What the CleanTalk plugin is used for

The CleanTalk Anti-Spam plugin is a subscription-based security service designed to prevent fake and harmful user behaviour on websites. It blocks spam registrations, filters out unwanted form submissions, protects email forms, and includes a firewall to stop malicious bots from accessing a site.

Because it operates as a software-as-a-service product, CleanTalk requires a valid API key to communicate with its external servers. These servers analyse user activity and determine whether behaviour is legitimate or suspicious. This connection is a core part of how the plugin functions.

However, the vulnerability was found within the process used to verify this API connection. When the plugin fails to confirm a valid API key, it switches to a backup method that is intended to handle trusted requests. Unfortunately, this fallback system is where the security weakness exists.

 

How the vulnerability works

The flaw lies in a function used when the plugin cannot validate communication with CleanTalk’s servers. Instead of securely checking the identity of the requester, the function relies on a weak verification method based on server information.

Attackers can exploit this weakness by pretending to be a trusted source associated with the cleantalk.org domain. By doing so, they are able to bypass the plugin’s normal security controls and perform actions that should be restricted to authorised systems only.

This vulnerability mainly affects websites that are running the plugin without a valid API key. These sites depend on the flawed verification method, making them easier targets for attackers.

Once the attacker bypasses the security checks, they can install vulnerable or malicious plugins on the website. These plugins can then be used to execute commands remotely, opening the door to a wide range of cyber attacks.

 

Warning from security researchers

The issue was highlighted in a security advisory published by Wordfence, a well-known provider of WordPress security solutions.

According to their report, the vulnerability allows unauthorised plugin installation due to an authorisation bypass linked to how the plugin verifies requests when no valid token is present. In simple terms, the plugin does not properly confirm who is making the request.

This means attackers can disguise themselves as a trusted service and gain access without needing usernames or passwords. Because no authentication is required, even websites with strong login security can still be affected if they are running an unpatched version of the plugin.

 

Which websites are most at risk

All CleanTalk plugin versions up to and including version 6.71 are vulnerable. Websites using these versions without updating remain exposed to attack.

Sites that do not have a valid API key configured are particularly at risk. These sites rely heavily on the flawed fallback verification process and therefore offer attackers an easier way in.

With the plugin installed on more than 200,000 websites, security experts warn that the vulnerability could be widely exploited if website owners delay updating their systems.

 

Steps website owners should take

Wordfence strongly recommends that users update the CleanTalk plugin immediately to the latest version, 6.72. This update fixes the vulnerability and prevents unauthorised plugin installation through the affected function.

Website administrators should also check that their API key is valid and correctly set up. Ensuring proper communication with CleanTalk’s servers reduces reliance on insecure backup checks.

In addition, site owners are advised to review their list of installed plugins and remove any that appear unfamiliar or suspicious. Keeping WordPress core software, themes, and plugins fully updated is one of the most effective ways to prevent security breaches.

Running regular security scans and monitoring site activity can also help detect unusual behaviour before serious damage is done.

 

Why plugin security is so important

This incident highlights how even trusted and widely used plugins can become security risks if vulnerabilities are not discovered and fixed quickly. Plugins that connect to external services or perform verification tasks must be especially well protected.

Cyber criminals often target popular plugins because a single vulnerability can give them access to thousands of websites at once. This makes timely updates essential for both small business owners and large organisations.

A compromised website can suffer from stolen customer data, damaged reputation, reduced search engine rankings, and loss of customer trust. In severe cases, websites may be taken offline entirely while the issue is resolved.

 

A reminder for WordPress users

The CleanTalk vulnerability serves as a strong reminder that website security is not a one-time task. It requires constant attention and regular maintenance.

Website owners should make it a routine practice to:

• Update plugins and themes promptly
• Use valid licences and API keys
• Remove unused plugins
• Monitor activity logs
• Back up their websites regularly

These steps can greatly reduce the risk of future attacks and help keep websites safe from emerging threats.

 

Looking ahead

As WordPress continues to power a large portion of the internet, security vulnerabilities will remain a key concern. Developers must ensure their software is thoroughly tested, and users must remain alert to updates and advisories.

The CleanTalk plugin flaw shows how quickly a single issue can put thousands of websites at risk. However, it also demonstrates the importance of the wider security community in identifying problems and providing fixes before they are exploited on a large scale.

For now, the most important action for website owners is simple: update immediately and review their security setup. Staying proactive is the best defence against evolving cyber threats.