The CleanTalk Spam protection plugin for WordPress is vulnerable because the checkWithoutToken function does not verify the authenticity of the API key when the site's reverse DNS PTR record is spoofed. This bypass allows any unauthenticated user to request the installation of arbitrary plugins. Installing a malicious plugin can give the attacker remote execution capabilities, especially if another plugin or core component is also vulnerable. The flaw arises from improper token validation (CWE‑350), and it only applies to sites that have an invalid or missing API key.

Vendor Cleantalk, product Spam protection, Honeypot, Anti‑Spam, all plugin versions up to 6.71 on WordPress sites. The flaw is present in every version through 6.71 and does not affect later releases.

The CVSS vector is 9.8, indicating a critical severity. The EPSS score of less than 1% suggests that exploitation attempts are expected to be rare, and it is not listed in the CISA KEV catalog. Nevertheless, the vulnerability is fully exploitable over the internet by spoofing the reverse DNS record of the target and triggering the plugin to install arbitrary code. The impact is confined to sites with an invalid API key, making educated attackers more likely to target such sites.