The CleanTalk Security & Malware scan WordPress plugin is vulnerable to an SQL Injection due to an authorization bypass via reverse DNS spoofing in the checkWithoutToken function and inadequate input validation. This vulnerability affects all versions up to and including 2.145. An unauthenticated attacker can append malicious SQL queries to existing database queries, potentially extracting sensitive data. The CVSS 3.1 base score is 7.5, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No patch or official fix has been published by the vendor as of the publication date.

Successful exploitation allows unauthenticated attackers to perform SQL Injection attacks, potentially extracting sensitive information from the plugin's database. The vulnerability does not impact integrity or availability directly but compromises confidentiality of data stored by the plugin. Given the network attack vector and no required privileges, the risk is significant for exposed WordPress sites using affected plugin versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling the affected plugin or restricting access to the vulnerable functionality. Monitor vendor channels for updates and apply patches promptly once available.