The vulnerability resides in the Maspik – Ultimate Spam Protection WordPress plugin, specifically the clear_log function where nonce validation is absent or incorrect. This deficiency permits unauthenticated attackers to send a forged request that triggers log clearance. The result is loss of spam activity records, which can conceal malicious activity and disrupt monitoring and auditing efforts. The weakness is formally categorized as CWE‑352, representing inadequate protection against CSRF attacks.

The flaw affects versions up to and including 2.5.6 of the Maspik – Ultimate Spam Protection plugin. Systems running any of these releases with WordPress installations are susceptible; no other vendors or products are listed as affected in the available CNA data.

The CVSS score of 4.3 indicates a moderate severity, while the EPSS score of less than 1% suggests a very low probability of exploitation at present. The vulnerability is not included in the CISA KEV catalog. Exploitation requires the attacker to trick a site administrator into submitting a forged request—commonly via a malicious link—making it a CSRF-based social engineering attack rather than a purely automated threat.