Security Alert Summary
The Dam Spam plugin for WordPress contains a Cross-Site Request Forgery (CWE-352) vulnerability that affects all versions up to and including 1.0.8. The issue is caused by missing nonce verification on the pending comment deletion action in the plugin’s cleanup page, which could allow an attacker to cause an administrator to delete all pending comments by tricking them into performing an action such as clicking a link.
CVE Details
- CVE ID:
CVE-2026-2112 - Affected component: Dam Spam plugin for WordPress
- Affected versions: All versions up to, and including, 1.0.8
- Patched / fixed version: Not specified in the CVE entry
- Published: February 18, 2026 at 8:16:15 AM
- Last modified: February 18, 2026 at 8:16:15 AM
- CVSS v3.1:
- Base score: 4.3
- Severity: MEDIUM
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- Authentication / privileges / user interaction:
- Privileges required: NONE (no authentication required)
- User interaction: REQUIRED (an admin must be tricked into taking an action)
- Primary impact:
- Confidentiality: NONE
- Integrity: LOW (deletion of pending comments)
- Availability: NONE
- CWE / weakness ID: CWE-352
Technical Details
The vulnerability is a Cross-Site Request Forgery (CSRF) issue caused by missing nonce verification on the pending comment deletion action in the plugin’s cleanup page. Because the cleanup action does not verify a WordPress nonce, an attacker can craft a forged request that triggers the pending comment deletion when an administrator performs a simple action (for example, clicking a link).
The CVE description and provided references point to the settings/cleanup.php implementation (see references) and specifically a call-site referenced at line 92 in that file in the repository and plugin sources. The absence of nonce checks on the pending comment deletion flow is the direct cause of the vulnerability.
Impact is limited to the ability to delete pending comments (integrity impact). The CVE does not indicate data disclosure, remote code execution, or availability impacts beyond that deletion behavior.
How This Could Impact Your Website
Consider a typical site with an owner, a few internal staff members who moderate comments, and an external contractor who contributes content. If an attacker lures an administrator or a user with comment-moderation capabilities into clicking a specially crafted link or visiting a page designed to submit the forged request, the pending comments queue could be cleared without the moderator’s intent. This can disrupt moderation workflows, remove legitimate pending feedback, and create administrative overhead to recover or repost moderated comments.
Because the CVE indicates no confidentiality impact, there is no indication from this entry that private user data would be exposed as a result of this vulnerability. However, deletion of moderation trails and comments can impede audits and record-keeping.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and capabilities, especially users who can moderate comments.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and moderation logs for unusual behavior or unexpected bulk deletions.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://github.com/webguyio/dam-spam/blob/52e12fb455e7b670af2e0713f9da84d2d1d309ac/settings/cleanup.php#L92
- https://plugins.trac.wordpress.org/browser/dam-spam/tags/1.0.6/settings/cleanup.php#L92
- https://plugins.trac.wordpress.org/browser/dam-spam/trunk/settings/cleanup.php#L92
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3457369%40dam-spam&new=3457369%40dam-spam&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/e336dc27-4a76-4197-929c-b221f42bfe69?source=cve
