Dam Spam <= 1.0.8 - Cross-Site Request Forgery to Arbitrary Pending Comment Deletion
mediumThe Dam Spam plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.8. This is due to missing nonce verification on the pending comment deletion action in the cleanup page. This makes it possible for unauthenticated attackers to delete all pending comments via a forge...
- CVSS:
- 4.3
- Affected:
- up to 1.0.8
- Fixed in:
- 1.0.9
- Disclosed:
- Feb 17, 2026