CVE-2026-1490

The record

The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due to an authorization bypass via reverse DNS (PTR record) spoofing on the 'checkWithoutToken' function in all versions up to, and including, 6.71. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated. Note: This is only exploitable on sites with an invalid API key.

Affected packages

Related vulnerabilities

• CVE-2026-55526 PraisonAI is a multi-agent teams system. CWE-350
• CVE-2026-46611 Glances is an open-source system cross-platform monitoring tool. CWE-350
• CVE-2026-12635 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.3 before… CWE-350
• CVE-2026-36604 Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 does not validate the… CWE-350
• GHSA-fvh2-gm75-j4j7 dynoxide: DNS rebinding and cross-origin CSRF via MCP HTTP transport CWE-350
• CVE-2026-42559 RMCP is an official Rust SDK for the Model Context Protocol. CWE-350
• GHSA-3vr4-cvmg-7fx4 copilot-api has Reliance on Reverse DNS Resolution for a Security-Critical Action CWE-350
• CVE-2026-6874 A vulnerability was determined in ericc-ch copilot-api up to 0.7.0. CWE-350