What’s Vulnerable › Vulnerabilities

CVE-2020-36698: Security & Malware scan by CleanTalk <= 2.50 - Missing Authorization

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-10-20 · updated 2026-06-17
• Weakness: CWE-862

Description

The Security & Malware scan by CleanTalk plugin for WordPress is vulnerable to unauthorized user interaction in versions up to, and including, 2.50. This is due to missing capability checks on several AJAX actions and nonce disclosure in the source page of the administrative dashboard. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to call functions and delete and/or upload files.

Affected products

• cleantalk Login Security, FireWall, Malware removal by CleanTalk: before 2.51 — fixed in 2.51

How to fix

Upgrade to a fixed version: cleantalk Login Security, FireWall, Malware removal by CleanTalk 2.51. Check the vendor advisory for mitigations.

References

• https://blog.nintechnet.com/multiple-vulnerabilities-fixed-in-security-malware-scan-by-cleantalk-plugin/
• https://wpscan.com/vulnerability/23960f42-dfc1-4951-9169-02d889283f01
• https://www.wordfence.com/threat-intel/vulnerabilities/id/0fb9b039-eb04-4c27-89eb-1932c9c31962?source=cve
• https://blog.nintechnet.com/multiple-vulnerabilities-fixed-in-security-malware-scan-by-cleantalk-plugin/
• https://wpscan.com/vulnerability/23960f42-dfc1-4951-9169-02d889283f01
• https://www.wordfence.com/threat-intel/vulnerabilities/id/0fb9b039-eb04-4c27-89eb-1932c9c31962?source=cve

Get alerted when CVE-2020-36698 or the next vulnerability affects your stack