CVE-2026-1490: 
WordPress vulnerability analysis and mitigation

CVE-2026-1490 is an authorization bypass vulnerability in the "Spam protection, Anti-Spam, FireWall by CleanTalk" WordPress plugin that allows unauthenticated attackers to install and activate arbitrary plugins via reverse DNS (PTR record) spoofing. The flaw exists in the checkWithoutToken function and affects all plugin versions up to and including 6.71. It was published on February 15, 2026, and carries a CVSS v3.1 base score of 9.8 (Critical) (Red Hat CVE, Wordfence). Exploitation is limited to sites operating with an invalid CleanTalk API key (Red Hat CVE).

The root cause is classified as CWE-350 (Reliance on Reverse DNS Resolution for a Security-Critical Action): the checkWithoutToken function performs authorization decisions based on PTR record lookups, which can be spoofed by an attacker who controls their own DNS infrastructure (Red Hat CVE). By crafting a malicious PTR record that resolves to a trusted hostname, an unauthenticated remote attacker can bypass the authorization check and trigger arbitrary plugin installation and activation via the WordPress plugin API. The precondition for exploitation is that the target WordPress site must have an invalid or missing CleanTalk API key, which causes the plugin to fall back to the vulnerable checkWithoutToken code path. A public proof-of-concept is available on GitHub (PoC GitHub).

Successful exploitation allows an unauthenticated attacker to install and activate any plugin available in the WordPress repository — or potentially a malicious one — on the affected site. If a subsequently installed plugin contains its own vulnerabilities, this can be chained to achieve full remote code execution, leading to complete site compromise including unauthorized data access, defacement, and malware installation (Red Hat CVE, Security Online). Approximately 200,000 WordPress sites using this plugin are potentially within scope, though only those with invalid API keys are directly exploitable (Security Online).

A proof-of-concept exploit was published on GitHub on February 15, 2026, shortly after the CVE was disclosed (PoC GitHub). As of the latest available intelligence, there is no confirmed evidence of active in-the-wild exploitation. The EPSS score is 0.000840 (approximately 0.08%), indicating a currently low but non-negligible probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. A Nuclei detection template pull request was submitted to the ProjectDiscovery repository, indicating growing community interest in automated scanning (Nuclei Templates PR).

1. Reconnaissance: Identify WordPress sites running the CleanTalk "Spam protection, Anti-Spam, FireWall" plugin version ≤ 6.71 using tools like WPScan, Shodan, or Censys. Determine whether the target site has an invalid or missing CleanTalk API key (e.g., by observing plugin behavior or error messages).
2. Set up malicious DNS infrastructure: Configure a PTR (reverse DNS) record for the attacker's IP address to resolve to a hostname that the checkWithoutToken function considers trusted, effectively spoofing the reverse DNS lookup.
3. Send crafted request: From the IP address with the spoofed PTR record, send an unauthenticated HTTP request to the WordPress site targeting the CleanTalk plugin's checkWithoutToken function endpoint, triggering the authorization bypass.
4. Install arbitrary plugin: With the authorization check bypassed, submit a request to install and activate a chosen plugin — either a legitimate but vulnerable plugin or a malicious one uploaded to a reachable location.
5. Achieve remote code execution: Leverage a vulnerability in the newly installed plugin (e.g., a file upload or code execution flaw) to execute arbitrary code on the server, gaining full control of the WordPress site (PoC GitHub, Red Hat CVE).

• Network: Unexpected HTTP POST requests to WordPress admin plugin installation endpoints (e.g., /wp-admin/update.php, /wp-admin/admin-ajax.php) from external IP addresses with no prior authenticated session; outbound connections from the web server to unknown plugin download sources.
• Logs: WordPress debug or access logs showing unauthenticated requests to CleanTalk plugin endpoints (checkWithoutToken); plugin installation events in wp-admin logs not associated with any authenticated administrator session.
• File System: Presence of newly installed or unfamiliar plugin directories under wp-content/plugins/; web shells or backdoor files within plugin directories; unexpected PHP files with obfuscated code.
• Process: Unusual child processes spawned by the web server process (e.g., php, curl, wget) making outbound network connections or writing files to the WordPress directory structure.

Update the CleanTalk "Spam protection, Anti-Spam, FireWall" plugin to version 6.72 or later, which contains the fix for this vulnerability (Red Hat CVE, Wordfence). As an immediate risk-reduction measure, ensure all WordPress sites using this plugin have a valid, active CleanTalk API key configured, since the vulnerability is only exploitable when the API key is invalid. Additionally, conduct a security audit of affected sites to identify any unauthorized plugin installations or suspicious file changes that may have occurred prior to patching.

The vulnerability received notable coverage across security media, with outlets such as Security Online, GBHackers, The Cyber Express, and Search Engine Journal highlighting the risk to approximately 200,000 WordPress sites (Security Online, GBHackers). Wordfence included it in their weekly WordPress vulnerability report, and the community submitted a Nuclei detection template to ProjectDiscovery's repository for automated scanning (Wordfence, Nuclei Templates PR). Social media discussion was observed on Mastodon and Bluesky, with security researchers sharing awareness of the PoC and patch availability.