Executive brief
CleanTalk is a popular WordPress spam-protection plugin used on thousands of websites. The plugin has a critical flaw that allows any website visitor to inject malicious code through comments. When a comment with embedded shortcodes is posted, the plugin's content-obfuscation feature inadvertently executes these shortcodes on the server, allowing an attacker to trigger arbitrary functionality—such as exposing files from private posts or executing plugin features—that is then rendered to all future visitors of the page.
Technical details
The vulnerability is an injection flaw (CWE-94: Improper Control of Generation of Code) in the CleanTalk plugin's "Encode contact data" feature. The plugin passes unauthenticated user-supplied comment content directly to WordPress's shortcode engine, bypassing WordPress core's deliberate design choice not to expand shortcodes in comments. An unauthenticated attacker can craft a comment containing a trigger tag ([apbct_encode_data]) followed by any registered shortcode with arbitrary attributes (e.g., [gallery ids="12"]) to achieve arbitrary shortcode execution. The vulnerability requires comments to be open and the plugin's "Encode contact data" setting to be enabled (both default states). An attacker can leverage this to execute any shortcode registered on the target site, potentially exposing private post data or triggering unintended plugin functionality. The vulnerability was fixed in version 6.87.
Affected products
- CleanTalk Spam protection, Honeypot, Anti-Spam before 6.87
Timeline
- 2026-09-07: disclosed
- 2026-09-07: patched: Fixed in version 6.87