The vulnerability in the CleanTalk WordPress plugin stems from improper validation of the 'api_key' parameter in the 'perform' function, enabling unauthorized arbitrary plugin installation and activation. This can be exploited by unauthenticated attackers to potentially achieve remote code execution, contingent on the presence of other vulnerable plugins. The issue is categorized as CWE-703, indicating improper handling of exceptional conditions. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability with network attack vector and no privileges required. No patch or official fix has been documented yet.

Successful exploitation allows unauthenticated attackers to install and activate arbitrary plugins on affected WordPress sites, which can lead to remote code execution if additional vulnerable plugins are installed. This compromises the confidentiality, integrity, and availability of the affected systems. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to WordPress administrative interfaces and monitor for suspicious plugin installations. Avoid installing untrusted plugins and consider disabling or removing the affected CleanTalk plugin if possible.