Atomic Edge analysis of CVE-2026-2112 (metadata-based):
This vulnerability is a Cross-Site Request Forgery (CSRF) flaw in the Dam Spam WordPress plugin, versions up to and including 1.0.8. The issue resides in the plugin’s cleanup page, where the pending comment deletion action lacks nonce verification. This allows unauthenticated attackers to delete all pending comments by tricking a site administrator into performing an action like clicking a malicious link. The CVSS score of 4.3 (Medium) reflects the requirement for user interaction and the limited impact on integrity.
Atomic Edge research indicates the root cause is missing nonce validation on a specific administrative function. The CWE-352 classification confirms a CSRF pattern where a state-changing action does not verify the request originates from an intended user. The vulnerability description explicitly states the missing nonce verification occurs on the pending comment deletion action in the cleanup page. Without access to source code, Atomic Edge infers the plugin likely uses a WordPress hook, such as `admin_post_{action}` or a custom admin menu callback, to handle the deletion request. The absence of a capability check for the requestor is not implied, as CSRF exploits the victim’s existing session and privileges.
Exploitation requires an attacker to craft a malicious web page or link that submits a forged HTTP request to the vulnerable WordPress endpoint. The attacker must lure a logged-in administrator to interact with this payload. Based on WordPress plugin conventions and the described ‘cleanup page,’ Atomic Edge infers the likely attack vector is a POST request to either `/wp-admin/admin.php?page={dam-spam-cleanup-slug}` or `/wp-admin/admin-post.php` with an action parameter. The payload would contain parameters instructing the plugin to delete pending comments, such as `action=dam_spam_delete_pending` and possibly `confirm=1` or `nonce=` with a blank or predictable value.
Remediation for this vulnerability requires implementing proper nonce verification. The patched version, 1.0.9, presumably added a call to `check_admin_referer()` or `wp_verify_nonce()` within the function handling the pending comment deletion. This ensures the request contains a cryptographically secure token tied to the user’s session, proving intent. The fix should also confirm the user has the appropriate capability, such as `moderate_comments`, though this check was likely already present and not the cause of the flaw.
The impact of successful exploitation is the unauthorized deletion of all pending comments on the WordPress site. This constitutes a loss of data integrity and can disrupt site moderation workflows. The attack does not allow for privilege escalation, remote code execution, or data theft. However, deleting pending comments can silence user feedback, remove legitimate content awaiting review, and generally undermine site administration.
