tadrik Free store check

Plugin security / CleanTalk Anti-Spam

CleanTalk Anti-Spam vulnerability: is your WooCommerce store affected?

CleanTalk Anti-Spam has 8 serious security holes rated 7 or higher out of 10 that someone can use with no login or with only a customer account. The newest was published on 9 October 2026. Every one is fixed: update to 6.90 or newer.

Short answer: your store is affected if it runs CleanTalk Anti-Spam older than 6.90. Update to 6.90 or newer, on a copy of the store first if you can.

In our check of 3,600 live UK and US WooCommerce stores (31 October 2026 to 1 November 2026), 18 were running a version of CleanTalk Anti-Spam with a serious hole that already had a fix. How we checked.

The security holes

Newest first. Each one is published in a public security database and fixed in the version shown.

  1. Cross-site scripting

    Someone could plant a script that runs in your visitors' or your admins' browsers.

    Score 7.2 (high)no login neededAffected: older than 6.90Fixed in 6.90Published 9 October 2026CVE-2026-109198

    Advisory: The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_email' parameter in all versions up to, and including, 6.89.1 due to...

  2. Cross-site scripting

    Someone could plant a script that runs in your visitors' or your admins' browsers.

    Score 7.2 (high)no login neededAffected: older than 6.87Fixed in 6.87Published 27 July 2026CVE-2026-77830

    Advisory: The Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content aria-label Placeholder in all versions up to, and including, 6.86 due to...

  3. Cross-site scripting

    Someone could plant a script that runs in your visitors' or your admins' browsers.

    Score 7.1 (high)no login neededAffected: older than 6.83Fixed in 6.83Published 11 June 2026CVE-2026-65437

    Advisory: Unauthenticated Cross Site Scripting (XSS) in Spam protection, AntiSpam, FireWall by CleanTalk <= 6.82 versions.

  4. Missing permission check

    An action that should need permission could be done without it.

    Score 9.8 (critical)no login neededAffected: older than 6.72Fixed in 6.72Published 14 February 2026CVE-2026-1490

    Advisory: The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due to an authorization bypass via reverse DNS (PTR record) spoofing on the...

  5. Missing permission check

    An action that should need permission could be done without it.

    Score 9.8 (critical)no login neededAffected: older than 6.44Fixed in 6.44Published 25 November 2024CVE-2024-10542

    Advisory: The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due to an authorization bypass via reverse DNS spoofing on the checkWithoutToken...

  6. Missing permission check

    An action that should need permission could be done without it.

    Score 8.1 (high)no login neededAffected: older than 6.45Fixed in 6.45Published 25 November 2024CVE-2024-10781

    Advisory: The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due to an missing empty value check on the 'api_key' value in the 'perform'...

  7. Missing permission check

    An action that should need permission could be done without it.

    Score 8.8 (high)needs only a customer accountAffected: older than 6.11Fixed in 6.11Published 22 June 2023CVE-2023-33996

    Advisory: Missing Authorization vulnerability in СleanTalk - Anti-Spam Protection Spam protection, AntiSpam, FireWall by CleanTalk allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spam...

1 older hole, published before 1 January 2023

  1. SQL injection

    Someone could read or change your database, which holds customer and order details.

    Score 7.5 (high)no login neededAffected: older than 5.153.4Fixed in 5.153.4Published 5 March 2021CVE-2021-24295

    Advisory: It was possible to exploit an Unauthenticated Time-Based Blind SQL Injection vulnerability in the Spam protection, AntiSpam, FireWall by CleanTalk WordPress Plugin before 5.153.4.

How to check your version

  1. Log in to WordPress and open Plugins > Installed Plugins.
  2. Find CleanTalk Anti-Spam. The version number is under its name. If it is lower than 6.90, your store is affected.
  3. No login to hand? Open https://yourstore.com/wp-content/plugins/cleantalk-spam-protect/readme.txt in a browser, with your own address in place of yourstore.com, and read the Stable tag line. Some hosts block this file; then use step 1.

How to fix it

  1. Make a backup, or better, a staging copy of the store (most hosts have a one-click staging button).
  2. On the copy, update CleanTalk Anti-Spam to 6.90 or newer: Dashboard > Updates, or Update now on the Plugins page.
  3. If no update shows, it may be a paid version whose licence has run out: download the new version from the seller's site and upload it.
  4. Place a test order on the copy: add to cart, check out, pay with a test method. Check the pages that use CleanTalk Anti-Spam.
  5. If everything works, make the same update on the live store and place one more test order.
  6. If you no longer use CleanTalk Anti-Spam, delete it instead of leaving it deactivated.

Not sure, or no time?

Get a free check of your store: we look at its public pages for plugins with known holes, and reply within one working day. Or we fix it for you: we update your store on a copy, place a test order, and only then change the live store, for a fixed £99 / $119.

Free store check Fix it for me on a copy

Questions

Which CleanTalk Anti-Spam version fixes it?
Version 6.90 or newer fixes all 8 issues on this page.
How do I know if my store is affected?
Your store is affected if it runs CleanTalk Anti-Spam older than 6.90. In WordPress, open Plugins and read the version under CleanTalk Anti-Spam. Without logging in, open yourstore.com/wp-content/plugins/cleantalk-spam-protect/readme.txt and read the Stable tag line.
I don't use CleanTalk Anti-Spam any more. Is a deactivated copy safe?
Deactivating it lowers the risk but leaves the old code on your server. If you don't use it, delete it; if you do, update it.
Can someone fix it for me?
Yes. We update the store on a copy first, place a test order, and only then make the same change on the live store, for a fixed price.

Vulnerability data: WPVulnerability (wpvulnerability.net, CC0), which links each entry to its CVE or advisory. Store numbers: Tadrik's own checks of public pages, aggregates only. Page updated 3 November 2026.