Executive Summary

This vulnerability is a Cross-Site Request Forgery (CSRF) issue in the Stop Spammers Classic plugin for WordPress, affecting all versions up to and including 2026.1. It occurs because the plugin's ss_addtoallowlist class lacks nonce validation, allowing unauthenticated attackers to add arbitrary email addresses to the spam allowlist by tricking a site administrator into performing an action, such as clicking a malicious link.

Useful 0 Not Useful 0

Impact Analysis

An attacker can exploit this vulnerability to add arbitrary email addresses to the spam allowlist without authentication. This could allow spam or malicious emails to bypass spam filters, potentially leading to increased spam, phishing attempts, or other unwanted communications reaching users or administrators.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update the Stop Spammers Classic plugin to a version later than 2026.1 where the partial patch has been applied. Additionally, avoid clicking on suspicious links and ensure that site administrators are aware of the risk of Cross-Site Request Forgery attacks.

Useful 0 Not Useful 0