Is CVE-2026-1490 actively exploited?

No active exploitation of CVE-2026-1490 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-1490 be exploited remotely?

Yes. CVE-2026-1490 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-1490?

CVE-2026-1490 has a CVSS score of 9.8 (CRITICAL) and an EPSS exploitation probability of 0.04%.

HOME VULNERABILITIESCVE-2026-1490

CRITICAL

CVE-2026-1490

CWE-350Published: February 15, 2026· Updated: Jun 17, 2026

9.8

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:9.2th

Official Description

The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due to an authorization bypass via reverse DNS (PTR record) spoofing on the 'checkWithoutToken' function in all versions up to, and including, 6.71. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated. Note: This is only exploitable on sites with an invalid API key.

NVD Source

Risk Analysis

This critical vulnerability in the CleanTalk plugin for WordPress allows unauthenticated attackers to install arbitrary plugins due to an authorization bypass. This can lead to remote code execution if another vulnerable plugin is installed and activated. With a CVSS score of 9.8, this flaw is highly severe, though the EPSS score suggests a low likelihood of exploitation.

No public exploit is currently known for this vulnerability. The attack vector is network-based with low attack complexity, meaning it can be exploited remotely without user interaction, specifically on sites with an invalid API key.

Recommended Action

Users should upgrade the Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress to version 6.72 or later. Ensure that a valid API key is configured for the plugin to prevent this exploitation path.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2026-1490 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.8.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorNetwork

Attack ComplexityLow

Privileges Req.None

User InteractionNone

ScopeUnchanged

Impact

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Vendors & Products

Mentioned vendors (from description):

WordPress

CPE data not yet available in NVD for this CVE.

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time

Exploit-DB

Offensive Security exploit database

GitHub PoC Search

Community PoC repositories

Rapid7 / Metasploit

Metasploit module search

PacketStorm

Security advisories & exploits

External links open in a new tab. Always verify in a controlled environment before use.

News & Research Mentioning CVE-2026-1490

Ivanti security advisory (AV26-696)

Canada CCCS· Jul 14, 2026

Serial number: AV26-696 Date: July 14, 2026 On July 14, 2026, Ivanti published a security advisory to address vulnerabilities in the following product: Ivanti Xtraction – version 2026.2 and prior The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates. Security Advisory Ivanti Xtraction (CVE-2026-14902, CVE-2026-14903) Ivanti Security Advisories