How CVE-2024-10781 Works
CleanTalk's remote-call interface hooks WordPress's init routine, so the handler runs on every front-end request — no login, nonce, or capability check stands in front of it. The handler compares a request-supplied token against the MD5 or SHA-256 digest of the site's CleanTalk API key. That comparison never verifies the key exists. On sites where no key is set, the matching digests are constants anyone can compute offline, and the gate opens. The attacker selects the plugin-installation action and names any plugin in the wordpress.org catalog. CleanTalk's own upgrader then writes the package — including PHP files — into wp-content/plugins and activates it, operations normally reserved for administrators. Per the disclosure, code execution is conditional on activating another vulnerable plugin; the unconditional impact is unauthorized plugin installation and full site integrity compromise.
Where BitFire PRO RASP Stops the Attack
BitFire PRO RASP is included with BitFire PRO and enforces authorization at the protected operation — and this attack has exactly one: writing PHP plugin files into wp-content/plugins. When the injected remote call reaches CleanTalk's upgrader and it attempts to create the package's PHP files, BitFire PRO RASP's filesystem guard classifies the write as unauthorized PHP creation, because no valid administrator session stands behind it, and blocks it. The attacker's chosen package never lands on disk, plugin activation has nothing to install, and the disclosure's conditional code-execution scenario collapses at its first requirement. Notably, the malicious request carries ordinary parameter values with no recognizable attack pattern. This is precisely the exploit class that runtime enforcement at the write is built to stop.
The Fix in CleanTalk 6.45
CleanTalk 6.45 closes the gate in lib/Cleantalk/ApbctWP/RemoteCalls.php. A new isRcAllowed() precheck runs before any token validation and terminates the request with a FORBIDDEN response unless the installation has a non-empty API key or a qualifying hosting license. The inline digest comparison is replaced by checkToken(), which builds its comparison secret only from a non-empty key and refuses to compare against an empty one, making the empty-string match impossible. Update to 6.45 or later immediately: the unauthenticated entry point and the install/activate code paths are unchanged, so only the repaired gate stands between an attacker and plugin installation.
If Your Site Was Affected, Investigate for Persistence.
Patching closes the known path; it does not undo a compromise that already happened. If your site ran CleanTalk 6.44 or earlier — particularly without an API key set — treat it as potentially compromised. Review your installed plugin list for anything you did not install, remove it, and rotate administrator credentials and WordPress authentication keys. Then run BitFire Threat Hunter. It performs a thorough post-compromise investigation and discovers backdoor WordPress administrator accounts, hidden database triggers, long-running PHP processes, and the droppers that can restore malware or reinfect the site. A missing suspicious file proves nothing; investigate before you consider the site clean.
Stop It at the Runtime, Not the Signature
CVE-2024-10781 turns a spam-filter plugin into an unauthenticated software installer. BitFire PRO RASP does not need to recognize the CVE: the moment the exploited remote call attempts to write PHP plugin files into wp-content/plugins, BitFire's filesystem guard blocks the unauthorized write, and the attack ends at the runtime operation it depends on. Patch to CleanTalk 6.45, investigate any site that ran an older version with BitFire Threat Hunter, and put BitFire PRO RASP in front of your WordPress filesystem today.
