CVE-2021-24295
mediumpriority · track · 32EPSS 0.047 · 92 %ileEURUUSEPSS · scored 2026-10-27
It was possible to exploit an Unauthenticated Time-Based Blind SQL Injection vulnerability in the Spam protection, AntiSpam, FireWall by CleanTalk WordPress Plugin before 5.153.4. The update_log function in lib/Cleantalk/ApbctWP/Firewall/SFW.php included a vulnerable query that could be injected via the User-Agent Header by manipulating the cookies set by the Spam protection, AntiSpam, FireWall by CleanTalk WordPress plugin before 5.153.4, sending an initial request to obtain a ct_sfw_pass_key cookie and then manually setting a separate ct_sfw_passed cookie and disallowing it from being reset.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5–7.5
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (5)
Products and version ranges known to be affected.
- cleantalk spam protection, antispam, firewall< 5.153.4nvdUScpe:2.3:a:cleantalk:spam_protection\,_antispam\,_firewall:*:*:*:*:*:*:*:*
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (7)
External citations — patches, advisories, analysis.
- https://nvd.nist.gov/vuln/detail/CVE-2021-24295cnnvd
- https://wpscan.com/vulnerability/152171fc-888c-4275-a118-5a1e664ef28bcnnvd
- https://www.wordfence.com/blog/2021/05/sql-injection-vulnerability-patched-in-cleantalk-antispam-plugin/cnnvd
- https://wpscan.com/vulnerability/152171fc-888c-4275-a118-5a1e664ef28benisa_euvd
- https://www.wordfence.com/blog/2021/05/sql-injection-vulnerability-patched-in-cleantalk-antispam-plugin/enisa_euvd
- https://wpscan.com/vulnerability/152171fc-888c-4275-a118-5a1e664ef28bThird Party Advisorynvd
- https://www.wordfence.com/blog/2021/05/sql-injection-vulnerability-patched-in-cleantalk-antispam-plugin/ExploitThird Party Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan