An Anonymous SQL Injection on Every Front-End Request
CleanTalk's SpamFireWall initializes on non-admin GET requests whenever the spam_firewall setting is enabled. A visitor who passes the check receives a ct_sfw_pass_key cookie, and replaying it with any non-empty ct_sfw_passed cookie forces SFW::check() to call update_log() on that request. In 5.153.3 and earlier, update_log() interpolated the raw User-Agent header into an INSERT ... ON DUPLICATE KEY UPDATE statement after only HTML-oriented sanitization — sanitize_text_field and htmlspecialchars — neither of which escapes SQL quotes. The finished string went straight to $wpdb->query, so header content could restructure the statement. The result is CVE-2021-24295 (CVSS 7.5): unauthenticated time-based blind SQL injection that lets an attacker infer and extract confidential database contents through response timing, with no login and no user interaction.
BitFire FREE WAF: Blocked Before WordPress Runs
This vulnerability lives entirely in the request: the payload is inbound request data and must carry SQL syntax to break out of the ua_name value. That is precisely the boundary BitFire's FREE web application firewall defends. The WAF inspects requests for SQL injection signatures and common evasion patterns, and blocks matching requests before WordPress or any plugin processes them. With BitFire enabled, the crafted User-Agent never reaches SFW::update_log(), the malicious statement is never assembled, and $wpdb->query never executes attacker SQL — the timing channel into your database never opens. The documented limitation is that the malicious SQL syntax must be present in inspected request data; this exploit cannot avoid that requirement, because its payload is the injection itself.
If Your Site Was Affected, Investigate for Persistence
Update to CleanTalk 5.153.4 or later now. The patch replaces both interpolated ua_name values with %s placeholders prepared through $wpdb->prepare, so request data can no longer alter statement structure. Patching closes this known path, but it does not erase a past compromise: anyone who exploited the bug earlier could have read database contents — including user tables — and used that access to entrench. Run BitFire Threat Hunter (BitFire PRO) to sweep the site for backdoor WordPress administrator accounts, hidden database triggers, long-running PHP processes, and droppers that can reinstall malware after cleanup. If your site ever ran an affected version, patch immediately, investigate, remove every persistence mechanism found, and rotate your database and administrator credentials.
Stop the Injection at the Door with BitFire
CVE-2021-24295 proves that even logging code can hand anonymous attackers a channel into your database. BitFire FREE's WAF closes that channel at the request layer, blocking SQL injection signatures before the vulnerable code executes — protection that works today, without waiting for a vendor patch. Install BitFire, enable the web application firewall, update CleanTalk immediately, and if your site ever ran 5.153.3 or older, follow up with a BitFire PRO Threat Hunter investigation. Block the request. Keep the database yours.
