The Dam Spam plugin for WordPress is vulnerable to Cross‑Site Request Forgery because the pending comment deletion action on the cleanup page lacks nonce verification. An unauthenticated attacker can trick an administrator into clicking a crafted link, causing all pending comments to be deleted. This results in loss of moderation data and disrupts site content integrity. The CVSS score of 4.3 reflects a moderate risk level for this type of data loss attack.

All installations of the webguyio Dam Spam WordPress plugin with a version of 1.0.8 or earlier are affected. The vulnerability is present in every release up to and including 1.0.8 and can be exploited in any WordPress environment that uses the plugin without additional CSRF safeguards.

The EPSS score is below 1%, indicating a low probability of exploitation under current conditions, and the issue is not listed in the CISA KEV catalog. The most likely attack vector is a social‑engineering attempt that lures an administrator into visiting a maliciously crafted URL. The absence of nonce checks allows the forged request to be processed without authentication, making the exploit straightforward once the admin acts.