CVE-2022-3302: 
WordPress vulnerability analysis and mitigation

The Anti-Spam by CleanTalk WordPress plugin versions before 5.185.1 contains a SQL injection vulnerability identified as CVE-2022-3302. The vulnerability affects high-privilege users such as administrators and was publicly disclosed on October 3, 2022. The issue exists in the plugin's spam logs deletion functionality (WPScan).

The vulnerability stems from improper validation of IDs before using them in SQL statements within the spam logs deletion feature. The issue is specifically located in the /edit-comments.php?page=ctcheckspam_logs endpoint. The vulnerability has been assigned a CVSS score of 6.8 (medium) and is classified under CWE-89 (SQL Injection). It falls under the OWASP Top 10 category A1: Injection (WPScan).

When exploited, this vulnerability could allow authenticated administrators to perform SQL injection attacks through the manipulation of the spamids[] parameter in the spam logs deletion functionality. This could potentially lead to unauthorized database access or manipulation (WPScan).

The vulnerability has been patched in version 5.185.1 of the Anti-Spam by CleanTalk plugin. Users are advised to update to this version or later to mitigate the risk (WPScan).