CVE

CVE-2021-24295

7.5

CVSS

Description

It was possible to exploit an Unauthenticated Time-Based Blind SQL Injection vulnerability in the Spam protection, AntiSpam, FireWall by CleanTalk WordPress Plugin before 5.153.4. The update_log function in lib/Cleantalk/ApbctWP/Firewall/SFW.php included a vulnerable query that could be injected via the User-Agent Header by manipulating the cookies set by the Spam protection, AntiSpam, FireWall by CleanTalk WordPress plugin before 5.153.4, sending an initial request to obtain a ct_sfw_pass_key cookie and then manually setting a separate ct_sfw_passed cookie and disallowing it from being reset.

Attack Vector

Privileges Req.

User Interaction

spam protection, antispam, firewall by cleantalk

Updated Oct 24, 2026View on NVD →

S4E scanner

highProduct Based Web Vulnerabilities~10 seconds

CVE-2021-24295 Scanner

CVE-2021-24295 Scanner - SQL Injection vulnerability in Spam protection, AntiSpam, FireWall by CleanTalk

Used 2.6k times · 3.4k assets checked · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: spam protection, antispam, firewall by cleantalk

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →