The Vulnerability: Unescaped POST Data in a DELETE Query
The flaw sits on the plugin's 'Scan logs' admin page, registered under the ct_check_spam_logs slug. bulk_actions_handler() verifies a valid bulk-spam nonce and the activate_plugins capability, then calls removeLogs(Post::get('spamids')). Post::get() applies only sanitize_textarea_field(), which coerces nothing to integers and neutralizes no SQL syntax. The inherited Comments::removeLogs() turns the array into $ids_string with implode(', ', $ids) and concatenates it into a DELETE against the cleantalk_spamscan_logs table through an unprepared $wpdb->query() call. Untrusted POST elements therefore cross directly into SQL text construction. There is no authorization weakness — only the session's own administrator can drive the handler — but that administrator's crafted values change what the statement deletes, exactly the injection the patch confirms.
BitFire FREE WAF: The Injection Dies at the Request Layer
This exploit cannot work without malicious SQL syntax inside the POST body, and that is exactly what the BitFire FREE WAF is built to catch. BitFire inspects form data and POST bodies before WordPress or the plugin processes them, matching injection syntax and common evasion patterns. A crafted spamids payload aimed at ct_check_spam_logs is flagged and blocked at the request layer — vulnerable removeLogs() code never executes. The detection is behavior-based, not a CVE-specific signature, so unknown injection variants get the same treatment. Because the vector requires a genuine administrator session and a valid nonce, bot filtering is not the decisive layer here; payload inspection is. The WAF ships with BitFire FREE for eligible non-commercial sites, and commercial sites simply add the appropriate license.
If Your Site Was Affected, Investigate for Persistence
Version 5.185.1 routes every spamids value through wp_parse_id_list() at both the entry point and the sink, coercing each element to a positive integer so the query can only ever receive a comma-separated list of integers. Update immediately. Patching closes this path, but it does not undo a compromise that already happened: injected SQL against a live database can leave persistence behind. Run BitFire Threat Hunter to sweep for backdoor administrator accounts, hidden database triggers, long-running PHP processes, and droppers that can restore malware or reinfect the site. Remove every discovered artifact and rotate the credentials a compromised database could expose — WordPress administrator passwords and database credentials included. A clean-looking file tree proves nothing on its own; investigate before you trust the site again.
Close the Gap with BitFire
SQL injection in an anti-spam plugin is still a direct line into your database. BitFire FREE's WAF stops CVE-2022-3302 at the request layer, before a single vulnerable line runs — and the same behavior-based inspection defends against injection flaws in every other plugin you run. Patch to 5.185.1, let BitFire Threat Hunter hunt for administrator backdoors, hidden triggers, and droppers, and rotate exposed credentials. Install BitFire FREE today and make request-layer injection defense the default on every WordPress site you operate.
