CVE-2026-2112
CSRF in Dam Spam WordPress Plugin Allows Pending Comment Deletion
Publication date: 2026-02-18
Last updated on: 2026-02-18
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| webguyio | dam_spam | to 1.0.8 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Dam Spam plugin for WordPress, in all versions up to and including 1.0.8, is vulnerable to a Cross-Site Request Forgery (CSRF) attack. This vulnerability arises because the plugin's cleanup page does not verify a security nonce when performing the action to delete all pending comments. As a result, an unauthenticated attacker can trick an administrator into clicking a malicious link, which then causes all pending comments to be deleted without the administrator's explicit consent.
How can this vulnerability impact me? :
This vulnerability allows an attacker to delete all pending comments on a WordPress site using the Dam Spam plugin without authentication. The impact is limited to the loss of pending comments, which could include legitimate user feedback or important moderation queues. Although it does not affect the confidentiality or availability of the site, it can disrupt comment moderation and potentially cause administrative inconvenience or loss of user-generated content awaiting approval.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability involves the Dam Spam WordPress plugin versions up to 1.0.8 lacking nonce verification on the pending comment deletion action, allowing unauthenticated attackers to delete pending comments if an admin is tricked into clicking a malicious link.'}, {'type': 'paragraph', 'content': 'Detection on your system can focus on monitoring for unauthorized or unexpected deletion of pending comments in the WordPress admin interface.'}, {'type': 'paragraph', 'content': 'Since the vulnerability exploits a missing nonce verification on a specific admin action, you can check your web server logs for suspicious HTTP POST requests to the cleanup page or URLs related to deleting pending comments without proper authentication.'}, {'type': 'paragraph', 'content': 'Suggested commands or methods include:'}, {'type': 'list_item', 'content': "Review web server access logs for POST requests to the Dam Spam plugin's cleanup page URL, especially those lacking valid authentication cookies or tokens."}, {'type': 'list_item', 'content': 'Use grep or similar tools to search logs for requests containing parameters related to deleting pending comments.'}, {'type': 'list_item', 'content': 'Example command to search Apache logs for suspicious POST requests to cleanup.php:'}, {'type': 'paragraph', 'content': "grep 'POST .*cleanup.php' /var/log/apache2/access.log | grep -v 'wordpress_logged_in_'"}, {'type': 'paragraph', 'content': "Additionally, monitor WordPress database tables for sudden or bulk deletion of comments with comment_approved = '0' (pending comments)."}] [1, 3]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'Immediate mitigation steps include:'}, {'type': 'list_item', 'content': 'Update the Dam Spam plugin to version 1.0.9 or later, which includes improved security with nonce verification and stricter capability checks to prevent unauthorized deletion of pending comments.'}, {'type': 'list_item', 'content': "Restrict access to the WordPress admin interface to trusted users only, ensuring that only users with the 'manage_options' capability can perform sensitive actions."}, {'type': 'list_item', 'content': 'Educate administrators to avoid clicking on suspicious links that could trigger forged requests.'}, {'type': 'list_item', 'content': 'Consider implementing additional security measures such as Web Application Firewalls (WAF) to block forged requests targeting the cleanup page.'}] [1, 3]