Summary
CVE-2026-66593 is an unauthenticated SQL injection vulnerability in the "Security & Malware scan by CleanTalk" WordPress plugin, affecting versions up to and including 2.184. The flaw allows a remote, unauthenticated attacker to inject SQL statements and interact directly with the site’s database. It carries a CVSS v3.1 base score of 9.3 (Critical).
Technical details
- Root cause: improper neutralization of user-supplied input before it is used in a SQL query (SQL Injection).
- Trigger conditions: no authentication is required to reach the vulnerable code path.
- Attack vector: network — exploitable remotely over HTTP(S) against any internet-exposed WordPress site running the vulnerable plugin version.
- Impact: unauthorized read access to database contents (e.g., credentials, user data); the CVSS vector indicates a scope change with high confidentiality impact and low availability impact, and no integrity impact.
Affected software
- Security & Malware scan by CleanTalk (WordPress plugin, package
security-malware-firewall) — versions up to and including 2.184.
Severity
- CVSS v3.1 Base Score: 9.3 (Critical)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Mitigation and recommended actions
- Immediate: Update the Security & Malware scan by CleanTalk plugin to version 2.185 or later.
- If patching cannot be performed immediately: consider disabling/deactivating the plugin until the update can be applied, and monitor web server/database logs for anomalous SQL error patterns or unexpected query behavior.

