CVE-2023-5239
📋 TL;DR
The CleanTalk Security & Malware Scan WordPress plugin before version 2.121 improperly trusts HTTP headers for client IP addresses, allowing attackers to spoof their IP. This can bypass brute-force protection mechanisms, potentially enabling unlimited login attempts. WordPress sites using vulnerable plugin versions are affected.
💻 Affected Systems
- CleanTalk Security & Malware Scan WordPress Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers bypass brute-force protection to conduct unlimited login attempts, potentially compromising administrator accounts and taking full control of the WordPress site.
Likely Case
Attackers bypass login rate-limiting to conduct credential stuffing attacks, increasing the chance of successful account compromise.
If Mitigated
With proper IP validation and rate-limiting at the web server level, attackers cannot bypass authentication protections.
🎯 Exploit Status
Exploitation requires sending specially crafted HTTP headers to spoof IP addresses.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.121
Vendor Advisory: https://wordpress.org/plugins/security-malware-firewall/#developers
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'Security & Malware scan by CleanTalk' and click 'Update Now'. 4. Verify plugin version is 2.121 or higher.
🔧 Temporary Workarounds
Disable Plugin
linuxTemporarily disable the vulnerable plugin until patched.
wp plugin deactivate security-malware-firewall
Web Server IP Validation
allConfigure web server to validate and sanitize client IP addresses before passing to WordPress.
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to detect and block IP spoofing attempts
- Enable additional authentication protections like two-factor authentication
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Installed Plugins for 'Security & Malware scan by CleanTalk' version below 2.121.Check Version:
wp plugin get security-malware-firewall --field=versionVerify Fix Applied:
Confirm plugin version is 2.121 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts from same spoofed IP
- Unusual HTTP headers like X-Forwarded-For with suspicious values
Network Indicators:
- HTTP requests with manipulated IP headers to login endpoints
SIEM Query:
source="wordpress.log" AND ("wp-login.php" OR "xmlrpc.php") AND ("X-Forwarded-For" OR "Client-IP")