Unauthenticated Stored XSS in the SpamFireWall Die Pages
CleanTalk's SpamFireWall hooks init at priority 1 and runs for every front-end request, anonymous included. When it denies a visitor — IP matched in the SFW table, Anti-Flood or Anti-Crawler limits tripped, or ?sfw_test_ip= forcing the test page — the plugin renders a 403 interstitial and dies. In 6.82, SFW.php captures $_SERVER['REQUEST_URI'] unsanitized, maps it to the {REQUEST_URI} placeholder, and injects it with str_replace into a single-quoted href attribute in die_page_sfw.html. Metacharacters in the request target break out of the attribute, so attacker-controlled markup and script execute on your site's origin. Anti-Flood and Anti-Crawler die pages repeat the same unescaped substitutions, and ?debug=1 adds raw header and $_SERVER dumps to the output.
BitFire FREE WAF Stops the Poisoned Request Before WordPress Runs
CVE-2026-65437 lives entirely in what the request carries: the malicious payload must ride in the URI for the die page to echo it. That is exactly the data BitFire's WAF inspects. BitFire FREE's web application firewall evaluates every URL, query string, and request target before WordPress loads a single plugin, detecting cross-site scripting syntax and common evasion patterns. A request target crafted for this CVE is flagged and blocked at the request layer — init never fires, Firewall::run() never executes, and no interstitial is ever rendered with attacker markup inside. This is behavior-based protection, so it needs no CVE-specific virtual patch. BitFire's WAF ships in BitFire FREE for eligible non-commercial sites; commercial sites need the appropriate commercial license.
If Your Site Was Affected, Investigate for Persistence
Update to CleanTalk 6.83 immediately — the release escapes every die-page substitution with esc_url(), esc_html(), and esc_attr() before the str_replace injection, so metacharacters can no longer terminate the attribute. The disclosure is a stored XSS: the attacker's URL and User-Agent persist in the apbct_sfw_logs table and are exported to CleanTalk's service, and the plugin source alone does not pin down every place that data may surface. Patching closes the known path; it does not undo a compromise that already happened. Script that ran in an administrator's browser can act with that session's authority. Run BitFire PRO Threat Hunter to sweep for backdoor administrator accounts, hidden database triggers, long-running PHP processes, and droppers that can restore malware — then remove every persistence mechanism and rotate credentials.
Block CVE-2026-65437 at the Request Layer with BitFire
CVE-2026-65437 turns a spam filter into an XSS delivery page, but the attack dies at BitFire's request layer: the FREE WAF detects the XSS payload in the request target and blocks it before WordPress or CleanTalk ever executes. Pair that prevention with fast patching to 6.83 and, for any site that ran 6.82 or earlier, a BitFire PRO Threat Hunter investigation to rule out leftover persistence. Deploy BitFire today and make the next vulnerable plugin irrelevant.
