Dam Spam
Dam Spam has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of September 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (100%).
The one issue recorded for Dam Spam has a vendor fix available, so running the current release closes it.
All of these findings were reported by Duong Quang Hao. Dam Spam is installed on roughly 3,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2026-2112Dam Spam <= 1.0.8 - Cross-Site Request Forgery to Arbitrary Pending Comment Deletion
Read the full analysisVulnerability Records

Dam Spam
Author
Web Guy
💬 Ask Question | 📧 Email Me Dam Spam is a spam protection plugin that blocks spam registrations, login attempts, comments, and contact form submissions. It provides multiple layers of protection including IP blocking, email validation, CAPTCHA challenges, and integration with third-party spam detection services. How it Works Dam Spam runs a series of configurable checks on registrations, logins, comments, and form submissions. When a submission is flagged as potentially suspicious, you can choose to block it outright or present a CAPTCHA challenge. Legitimate users are cached to speed up future submissions, while known spam sources are permanently blocked. Features Multiple Protection Layers: Block spam using IP lists, disposable email detection, and behavioral analysis CAPTCHA Support: Integrate with Google reCAPTCHA or hCaptcha to challenge suspicious submissions Third-Party API Integration: Connect with Akismet, Stop Forum Spam, BotScout, and other spam detection services Customizable Challenges: Present challenges only to suspicious users while allowing legitimate users through Allow and Block Lists: Maintain custom lists of allowed and blocked IPs, emails, and user IDs Smart Caching: Cache known good and bad IPs to improve performance and reduce API calls Logging: Track all blocked attempts and approved submissions for review Custom Login/Registration Forms: Optional custom forms with built-in spam protection User Management: Identify and manage inactive or suspicious user accounts Configuration After installation, go to the Dam Spam settings in your WordPress admin to: Enable the protection types you need (registration, login, comments, contact forms) Choose which spam detection methods to use (IP checks, email validation, third-party APIs) Configure CAPTCHA settings if desired Set up allow and block lists for your specific needs Review logs to fine-tune your protection settings Differences from Stop Spammers Dam Spam is a fork of Stop Spammers. While the core spam protection functionality remains similar, Dam Spam’s file and code structure has been significantly cleaned up and modernized. Addon Support Dam Spam supports custom spam checks via addons. Create a separate plugin with this structure: <?php /* Plugin Name: Dam Spam Addon Example Description: Custom spam check addon for Dam Spam Version: 1.0 */ add_filter( 'dam_spam_addons_block', function( $addons ) { $addons[] = array( __FILE__, 'My_Spam_Check' ); return $addons; } ); class My_Spam_Check { public function process( $ip, &$stats, &$options, &$post ) { if ( $ip === '123.45.67.89' ) { return 'Blocked by custom check'; } return false; } } Hook into dam_spam_addons_block or dam_spam_addons_allow Return an array with your file path and class name Create a class with a process() method For dam_spam_addons_block: return false to continue checking, or a string to block For dam_spam_addons_allow: return false to continue checking, or a string to approve Test using Dam Spam > Testing (spam checks don’t run when logged in)
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C