CVE-2022-1709: Gti Throws Spam Away

Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days.

The Throws SPAM Away WordPress plugin before 3.3.1 does not have CSRF checks in place when deleting comments (either all, spam, or pending), allowing attackers to make a logged in admin delete comments via a CSRF attack

Affected products

• Gti Throws Spam Away: before 3.3.1 (fixed in 3.3.1)

Published 2022-06-08. Last modified 2026-06-17.