CVE-2026-2112 describes a CSRF vulnerability in the Dam Spam plugin for WordPress, affecting all versions up to 1.0.8. The issue arises because the plugin does not implement nonce verification on the cleanup page's pending comment deletion action. As a result, an attacker can craft a malicious request that, if an admin user interacts with it (e.g., by clicking a link), causes deletion of all pending comments without proper authorization. The vulnerability is rated medium severity with a CVSS 3.1 base score of 4.3, reflecting low complexity and no privileges required but requiring user interaction.

An attacker can cause the deletion of all pending comments on a WordPress site using the Dam Spam plugin by exploiting this CSRF vulnerability. This results in loss of pending comment data, which may disrupt site moderation workflows. There is no indication of confidentiality or availability impact beyond the integrity loss of pending comments. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid interacting with untrusted links or requests that could trigger comment deletion actions. Monitoring for plugin updates from webguyio is recommended to apply any forthcoming patches addressing this vulnerability.