Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

WordPress CleanTalk plugin may let attackers change data

CVE-2026-66593 · published 2 months ago
Summary

The CleanTalk security and malware scanning plugin for WordPress, up to version 2.184, can be accessed by anyone on the internet and used to send special messages that alter the website’s database. This could allow an attacker to view, modify, or delete information stored by the site. Update the plugin to the latest version or remove it if you cannot upgrade.

What to do
  • Update cleantalk inc security & malware scan by cleantalk to version 2.185.
Affected software
VendorProductAffected versions
cleantalk inc security & malware scan by cleantalk <= 2.184
Fix: upgrade to 2.185
Original advisory text
Unauthenticated SQL Injection in Security & Malware scan by CleanTalk <= 2.184 versions.
Unauthenticated SQL Injection in Security & Malware scan by CleanTalk <= 2.184 versions.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
9.3 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published20 Aug 2026
Updated30 Oct 2026
First seen20 Aug 2026
Sources
CVE-2026-66593 · NVD
CVE-2026-66593 · MITRE
Track software like this
Free during beta