Analysis Report · cleantalk-spam-protect 6.43 → 6.44 — CVE-2024-10542

--- cache/cleantalk-spam-protect_6.43/inc/cleantalk-settings.php	2026-01-07 16:23:14.961172611 +0000+++ cache/cleantalk-spam-protect_6.44/inc/cleantalk-settings.php	2026-01-07 16:23:27.957980940 +0000@@ -2,6 +2,7 @@  use Cleantalk\ApbctWP\AdjustToEnvironmentModule\AdjustToEnvironmentHandler; use Cleantalk\ApbctWP\AdjustToEnvironmentModule\AdjustToEnvironmentSettings;+use Cleantalk\ApbctWP\Antispam\EmailEncoder; use Cleantalk\ApbctWP\Escape; use Cleantalk\ApbctWP\Helper; use Cleantalk\ApbctWP\LinkConstructor;@@ -110,6 +111,11 @@         ? '<br>' . __(' - status of SpamFireWall database updating process', 'cleantalk-spam-protect')         : ''; +    $current_user = wp_get_current_user();+    $current_user_email = $current_user->exists() ? $current_user->user_email : '[email protected]';+    $emailEncoder = EmailEncoder::getInstance();+    $current_user_email = $emailEncoder->ignoreOpenSSLMode()->modifyContent($current_user_email);+     $fields = array(          'main' => array(@@ -182,8 +188,30 @@                 'data__email_decoder'        => array(                     'type'        => 'checkbox',                     'title'       => __('Encode contact data', 'cleantalk-spam-protect'),-                    'description' => __('Turn on this option to prevent crawlers grab contact data (emails) from website content.', 'cleantalk-spam-protect'),-                    'long_description' => true,+                    'description' =>+                        sprintf(+                            __(+                                'This option allows you to encode contacts on the public pages of the site. This prevents robots from automatically collecting such data and prevents it from being included in spam lists. %s',+                                'cleantalk-spam-protect'+                            ),+                            '<a href="https://blog.cleantalk.org/wordpress-how-hide-email-address-from-bots-and-spammers/?utm_source=apbct_hint_data__email_decoder&utm_medium=WordPress&utm_campaign=ABPCT_Settings" target="_blank">' . __(+                                'Learn more.',+                                'cleantalk-spam-protect'+                            ) . '</a>'+                        )+                        . '<br><span id="apbct-email-decoder-example-text">' . __(+                            'Try to decode, just click on email ',+                            'cleantalk-spam-protect'+                        ) . '</span>'+                        . '<span id="apbct-email-decoder-example-email">' . $current_user_email . '</span>'+                        . '<br>'+                        . sprintf(+                            __(+                                'If the option was turned off, you can anyway encode contact data using shortcode\hook. Learn more %s.',+                                'cleantalk-spam-protect'+                            ),+                            '<a href="#" target="_blank">' . __('here', 'cleantalk-spam-protect') . '</a>'+                        )                 ),                 'comments__the_real_person' => array(                     'type'        => 'checkbox',@@ -290,6 +318,21 @@                         'cleantalk-spam-protect'                     ),                 ),+                'data__honeypot_field' => array(+                    'title'           => __(+                        'Add a honeypot field',+                        'cleantalk-spam-protect'+                    ),+                    'description'     => __(+                        'This option adds a honeypot field to the forms.',+                        'cleantalk-spam-protect'+                    ),+                    'options'         => array(+                        array('val' => 1, 'label' => __('On')),+                        array('val' => 0, 'label' => __('Off')),+                    ),+                    'long_description' => true,+                ),             ),         ), @@ -605,26 +648,28 @@                     'title'       => __('Show email existence alert when filling in the field', 'cleantalk-spam-protect'),                     'description' => __('Check email address exist before sending form data', 'cleantalk-spam-protect'),                 ),-                'data__honeypot_field'         => array(-                    'title'           => __(-                        'Add a honeypot field',-                        'cleantalk-spam-protect'-                    ),-                    'description'     => __(-                        'This option adds a honeypot field to the forms.',-                        'cleantalk-spam-protect'-                    ),-                    'options'         => array(-                        array('val' => 1, 'label' => __('On')),-                        array('val' => 0, 'label' => __('Off')),-                    ),-                    'long_description' => true,-                ),                 'data__email_decoder'        => array(-                    'title'       => __('Encode contact data', 'cleantalk-spam-protect'),-                    'description' => __('Turn on this option to prevent crawlers grab contact data (emails) from website content.', 'cleantalk-spam-protect'),-                    'long_description' => true,-                    'childrens'   => array('data__email_decoder_buffer')+                    'title' => __('Encode contact data', 'cleantalk-spam-protect'),+                    'description' =>+                        sprintf(+                            __(+                                'This option allows you to encode contacts on the public pages of the site. This prevents robots from automatically collecting such data and prevents it from being included in spam lists. %s',+                                'cleantalk-spam-protect'+                            ),+                            '<a href="https://blog.cleantalk.org/wordpress-how-hide-email-address-from-bots-and-spammers/?utm_source=apbct_hint_data__email_decoder&utm_medium=WordPress&utm_campaign=ABPCT_Settings" target="_blank">' . __(+                                'Learn more.',+                                'cleantalk-spam-protect'+                            ) . '</a>'+                        )+                        . '<br>'+                        . sprintf(+                            __(+                                'If the option was turned off, you can anyway encode contact data using shortcode\hook. Learn more %s.',+                                'cleantalk-spam-protect'+                            ),+                            '<a href="#" target="_blank">' . __('here', 'cleantalk-spam-protect') . '</a>'+                        ),+                    'childrens' => array('data__email_decoder_buffer')                 ),                 'data__email_decoder_buffer'        => array(                     'title'       => __('Use the output buffer', 'cleantalk-spam-protect'),@@ -1544,6 +1589,7 @@                 'Error occurred on last SpamFireWall check. ',                 'cleantalk-spam-protect'             ),+            'email_encoder'           => __('Email encoder:', 'cleantalk-spam-protect'),              // Validating settings             'settings_validate' => 'Validate Settings',@@ -3292,7 +3338,7 @@             //HANDLE LINK             'desc'  => sprintf(                 esc_html__('The option helps to block bots . The honeypot field option adds a hidden field to the form. When spambots come to a website form, they can fill out each input field. Enable this option to make the protection stronger on these forms. Learn more about supported forms %s', 'cleantalk-spam-protect'),-                '<a href="https://cleantalk.org/help/wordpress-plugin-settings{utm_mark}#honeypot" target="_blank">' . __('here.', 'cleantalk-spam-protect') . '</a>'+                '<a href="https://cleantalk.org/help/honeypot-field{utm_mark}" target="_blank">' . __('here.', 'cleantalk-spam-protect') . '</a>'             )         ),         'sfw__enabled' => array(@@ -3307,14 +3353,6 @@                 '<a href="https://cleantalk.org/help/anti-flood-and-anti-crawler{utm_mark}" target="_blank">' . __('here.', 'cleantalk-spam-protect') . '</a>'             )         ),-        'data__email_decoder' => array(-            'title' => __('Encode contact data', 'cleantalk-spam-protect'),-            //HANDLE LINK-            'desc'  => sprintf(-                __('This option allows you to encode contacts on the public pages of the site. This prevents robots from automatically collecting such data and prevents it from being included in spam lists. %s', 'cleantalk-spam-protect'),-                '<a href="https://cleantalk.org/help/email-encode{utm_mark}" target="_blank">' . __('Learn more.', 'cleantalk-spam-protect') . '</a>'-            )-        ),         'exclusions__form_signs' => array(             'title' => __('Form Signs Exclusions', 'cleantalk-spam-protect'),             'desc'  => __('The plugin will check the POST array to find regular expressions matches. Usually, field\'s 

Let me analyze the security implications of this diff:

---

**Vulnerability 1:**

Vulnerability Existed: yes
FALSE POSITIVE
Stored XSS (Cross-Site Scripting) - CWE-79 - inc/cleantalk-settings.php Lines 207-210
Old Code:
```php
'description' => __('Turn on this option to prevent crawlers grab contact data (emails) from website content.', 'cleantalk-spam-protect'),
'long_description' => true,
```

Fixed Code:
```php
'description' =>
    sprintf(
        __(
            'This option allows you to encode contacts on the public pages of the site. This prevents robots from automatically collecting such data and prevents it from being included in spam lists. %s',
            'cleantalk-spam-protect'
        ),
        '<a href="https://blog.cleantalk.org/wordpress-how-hide-email-address-from-bots-and-spammers/?utm_source=apbct_hint_data__email_decoder&utm_medium=WordPress&utm_campaign=ABPCT_Settings" target="_blank">' . __(
            'Learn more.',
            'cleantalk-spam-protect'
        ) . '</a>'
    )
    . '<br><span id="apbct-email-decoder-example-text">' . __(
        'Try to decode, just click on email ',
        'cleantalk-spam-protect'
    ) . '</span>'
    . '<span id="apbct-email-decoder-example-email">' . $current_user_email . '</span>'
```

Explanation:
The fix adds `$current_user_email` which is encoded via `EmailEncoder::getInstance()->ignoreOpenSSLMode()->modifyContent()` before being output in the description field. This encoding prevents XSS attacks. The old code had a simpler description without email output, so it had lower XSS risk. The new code properly encodes the current user's email address before displaying it in HTML context, mitigating Stored XSS vulnerability.

---

**Vulnerability 2:**

Vulnerability Existed: not sure
Improper Input Validation / Unvalidated URL Redirect - CWE-601 - inc/cleantalk-settings.php Line 3341
Old Code:
```php
'<a href="https://cleantalk.org/help/wordpress-plugin-settings{utm_mark}#honeypot" target="_blank">' . __('here.', 'cleantalk-spam-protect') . '</a>'
```

Fixed Code:
```php
'<a href="https://cleantalk.org/help/honeypot-field{utm_mark}" target="_blank">' . __('here.', 'cleantalk-spam-protect') . '</a>'
```

Explanation:
The change modifies the URL path from `wordpress-plugin-settings{utm_mark}#honeypot` to `honeypot-field{utm_mark}`. Both are hardcoded URLs to the cleantalk.org domain with proper https protocol. Neither presents a clear unvalidated redirect vulnerability since the domain is hardcoded. The change appears to be updating to a more specific help page URL rather than a security fix. The `{utm_mark}` placeholder suggests server-side replacement of utm parameters, which is a normal tracking practice. Not a confirmed vulnerability.

---

**Vulnerability 3:**

Vulnerability Existed: no
Information Disclosure / Sensitive Data Exposure - CWE-200 - inc/cleantalk-settings.php Lines 114-117
Old Code:
(No previous code - this is new code added)

Fixed Code:
```php
$current_user = wp_get_current_user();
$current_user_email = $current_user->exists() ? $current_user->user_email : '[email protected]';
$emailEncoder = EmailEncoder::getInstance();
$current_user_email = $emailEncoder->ignoreOpenSSLMode()->modifyContent($current_user_email);
```

Explanation:
This new code retrieves the current user's email and encodes it before display. The code includes proper checks: `$current_user->exists()` validates the user exists before accessing `user_email`. A fallback to `'[email protected]'` is used if no user exists. The email is then encoded using `EmailEncoder` before being output in HTML. This is NOT vulnerable because: (1) it accesses WordPress's authenticated user context (safe), (2) it validates existence before access, and (3) it properly encodes output. This demonstrates a security-conscious approach to handling sensitive user data.

The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due to an authorization bypass via reverse DNS spoofing on the checkWithoutToken function in all versions up to, and including, 6.43.2. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated.

--- cache/cleantalk-spam-protect_6.43/lib/Cleantalk/ApbctWP/RemoteCalls.php	2026-01-07 16:23:14.997174850 +0000+++ cache/cleantalk-spam-protect_6.44/lib/Cleantalk/ApbctWP/RemoteCalls.php	2026-01-07 16:23:28.005983926 +0000@@ -12,6 +12,11 @@ {     const COOLDOWN = 10; +    private static $allowedActionsWithoutToken = [+        'get_fresh_wpnonce',+        'post_api_key',+    ];+     /**      * Checking if the current request is the Remote Call      *@@ -31,14 +36,24 @@                in_array(Request::get('plugin_name'), array('antispam', 'anti-spam', 'apbct'));     } +    private static function isAllowedWithoutToken($rc)+    {+        return in_array($rc, self::$allowedActionsWithoutToken, true);+    }+     public static function checkWithoutToken()     {         global $apbct; +        $rc_servers = [+            'netserv3.cleantalk.org',+            'netserv4.cleantalk.org',+        ];+         $is_noc_request = ! $apbct->key_is_ok &&             Request::get('spbc_remote_call_action') &&             in_array(Request::get('plugin_name'), array('antispam', 'anti-spam', 'apbct')) &&-            strpos(Helper::ipResolve(Helper::ipGet()), 'cleantalk.org') !== false;+            in_array(Helper::ipResolve(Helper::ipGet('remote_addr')), $rc_servers, true);          // no token needs for this action, at least for now         // todo Probably we still need to validate this, consult with analytics team@@ -79,7 +94,7 @@                 if (                     ($token === strtolower(md5($apbct->api_key)) ||                      $token === strtolower(hash('sha256', $apbct->api_key))) ||-                    self::checkWithoutToken()+                    (self::checkWithoutToken() && self::isAllowedWithoutToken($action))                 ) {                     // Flag to let plugin know that Remote Call is running.                     $apbct->rc_running = true;

Based on my analysis of the code diff between versions 6.43 and 6.44, here are the security vulnerabilities and fixes:

---

**Vulnerability 1:**

Vulnerability Existed: yes
TRUE POSITIVE

Improper Input Validation - CWE-20 - lib/Cleantalk/ApbctWP/RemoteCalls.php Lines 31-41 (old) vs 53-56 (new)

Old Code:
```php
$is_noc_request = ! $apbct->key_is_ok &&
    Request::get('spbc_remote_call_action') &&
    in_array(Request::get('plugin_name'), array('antispam', 'anti-spam', 'apbct')) &&
    strpos(Helper::ipResolve(Helper::ipGet()), 'cleantalk.org') !== false;
```

Fixed Code:
```php
$rc_servers = [
    'netserv3.cleantalk.org',
    'netserv4.cleantalk.org',
];

$is_noc_request = ! $apbct->key_is_ok &&
    Request::get('spbc_remote_call_action') &&
    in_array(Request::get('plugin_name'), array('antispam', 'anti-spam', 'apbct')) &&
    in_array(Helper::ipResolve(Helper::ipGet('remote_addr')), $rc_servers, true);
```

Explanation:
The original code used `strpos()` to check if the resolved IP contains 'cleantalk.org', which is vulnerable to IP spoofing and pattern matching bypass. For example, an attacker could use an IP resolving to a domain like 'evil-cleantalk.org.attacker.com' to bypass the check. The fix replaces this with a strict whitelist comparison using `in_array()` with strict type checking (`true` parameter), restricting remote calls to only two specific allowed servers. Additionally, the fix changes `Helper::ipGet()` to `Helper::ipGet('remote_addr')` to explicitly specify the source IP, improving clarity and security.

---

**Vulnerability 2:**

Vulnerability Existed: yes
TRUE POSITIVE

Insufficient Access Control / Unrestricted Remote Command Execution - CWE-94 - lib/Cleantalk/ApbctWP/RemoteCalls.php Lines 79-82 (old) vs 94-97 (new)

Old Code:
```php
if (
    ($token === strtolower(md5($apbct->api_key)) ||
     $token === strtolower(hash('sha256', $apbct->api_key))) ||
    self::checkWithoutToken()
) {
```

Fixed Code:
```php
if (
    ($token === strtolower(md5($apbct->api_key)) ||
     $token === strtolower(hash('sha256', $apbct->api_key))) ||
    (self::checkWithoutToken() && self::isAllowedWithoutToken($action))
) {
```

Explanation:
The original code allowed ANY remote call action to execute if `checkWithoutToken()` returned true. The vulnerability exists because `checkWithoutToken()` only validates the request source (IP and basic parameters), not the specific action being performed. This allowed unauthorized remote actions like `action__sfw_update`, `action__debug`, `action__post_api_key`, etc., to execute without proper token authentication. The fix implements an action whitelist via the new `isAllowedWithoutToken()` method, which restricts token-less execution to only two safe actions: 'get_fresh_wpnonce' and 'post_api_key'. This prevents unauthorized remote code execution through NoC (Network Operations Center) requests.

The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due to an authorization bypass via reverse DNS spoofing on the checkWithoutToken function in all versions up to, and including, 6.43.2. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated.