CVE-2024-10542: CleanTalk Anti-Spam Auth Bypass Vulnerability

CVE-2024-10542 Overview

CVE-2024-10542 is an authorization bypass vulnerability in the Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress. The flaw resides in the checkWithoutToken function and affects all versions up to and including 6.43.2. Unauthenticated attackers can spoof reverse DNS records to bypass authorization checks and install or activate arbitrary plugins on the target site. When chained with another vulnerable plugin, the issue enables remote code execution on the WordPress host. The vulnerability is tracked under CWE-862: Missing Authorization and carries an EPSS probability of 40.965%, placing it in the 97th percentile for likelihood of exploitation.

Critical Impact

Unauthenticated attackers can install and activate arbitrary WordPress plugins, leading to remote code execution when paired with a second vulnerable plugin.

Affected Products

• CleanTalk Anti-Spam plugin for WordPress, all versions up to and including 6.43.2
• WordPress sites running the Spam protection, Anti-Spam, FireWall by CleanTalk plugin
• Any WordPress deployment where the CleanTalk plugin is installed alongside other plugins that contain exploitable code paths

Discovery Timeline

• 2024-11-26 - CVE-2024-10542 published to NVD
• 2025-07-12 - Last updated in NVD database

Technical Details for CVE-2024-10542

Vulnerability Analysis

The CleanTalk Anti-Spam plugin exposes a remote call mechanism intended to allow the CleanTalk service to perform administrative operations on a WordPress site without a token. The checkWithoutToken function in lib/Cleantalk/ApbctWP/RemoteCalls.php validates the source of incoming requests by performing a reverse DNS lookup on the client IP address and comparing the returned hostname against CleanTalk-controlled domains. An attacker who controls the PTR record for an IP address they own can return a hostname that satisfies the check, bypassing authorization entirely. Once the check passes, the remote call handler exposes administrative operations including arbitrary plugin installation and activation, which an attacker can leverage to drop a malicious or known-vulnerable plugin and pivot to code execution.

Root Cause

The root cause is the use of reverse DNS lookups as the sole authentication mechanism for privileged operations. PTR records are controlled by the owner of the IP address block, so an attacker with control over their own rDNS can forge any hostname they choose. The checkWithoutToken implementation trusts the result of the lookup without performing a forward-confirmed reverse DNS (FCrDNS) validation or any cryptographic verification.

Attack Vector

The vulnerability is exploitable over the network without authentication or user interaction. An attacker provisions an IP address with a PTR record pointing to a CleanTalk-controlled hostname, then issues an HTTP request to the WordPress site invoking the CleanTalk remote call endpoint. After the spoofed rDNS check succeeds, the attacker submits a request to install and activate an arbitrary plugin from a URL of their choosing.

No verified public proof-of-concept code is available. The vulnerable code path is published in the CleanTalk RemoteCalls source and the fix can be reviewed in WordPress CleanTalk Changeset 3179819.

Detection Methods for CVE-2024-10542

Indicators of Compromise

• HTTP requests to CleanTalk remote call endpoints originating from IP addresses whose PTR records resolve to *.cleantalk.org but whose forward DNS does not match
• Unexpected entries in the WordPress wp_options table referencing newly installed plugins
• Plugin directories appearing under wp-content/plugins/ without a corresponding administrator action in audit logs
• Outbound HTTP requests from the WordPress host fetching plugin ZIP archives from non-WordPress.org domains

Detection Strategies

• Inspect web server access logs for POST requests to the CleanTalk plugin endpoints followed by plugin installation activity
• Perform forward-confirmed reverse DNS validation on source IPs accessing CleanTalk remote call routes and flag mismatches
• Compare the installed plugin inventory against an approved baseline and alert on additions
• Monitor file integrity for the wp-content/plugins/ directory and trigger on new directory creation

Monitoring Recommendations

• Forward WordPress audit logs and web access logs to a centralized analytics platform for correlation
• Alert on plugin activation events that occur outside of authenticated administrator sessions
• Track outbound network connections from PHP worker processes that download archives or executable content

How to Mitigate CVE-2024-10542

Immediate Actions Required

• Upgrade the CleanTalk Anti-Spam plugin to a version newer than 6.43.2 on all WordPress sites
• Audit wp-content/plugins/ for unexpected plugin directories and remove any unauthorized installations
• Review WordPress administrator accounts and recent option changes for signs of post-exploitation activity
• Restrict outbound network access from WordPress hosts to prevent retrieval of attacker-controlled plugin archives

Patch Information

The vendor addressed the authorization bypass in WordPress CleanTalk Changeset 3179819. Site administrators should update to the latest CleanTalk Anti-Spam release through the WordPress plugin manager or by replacing the plugin directory with the patched version. Refer to the Wordfence Vulnerability Report for additional vendor guidance.

Workarounds

• Deactivate and remove the CleanTalk Anti-Spam plugin until it can be upgraded to a fixed version
• Block requests to the CleanTalk remote call endpoints at a web application firewall when the source IP is not on a verified allowlist
• Disable plugin installation by setting define('DISALLOW_FILE_MODS', true); in wp-config.php to prevent runtime plugin installs

# Configuration example: disable plugin and theme installation in wp-config.php
define('DISALLOW_FILE_MODS', true);