The folks over at CleanTalk have added a new feature over time. The CleanTalk Certified program, officially known as the Plugin Security Certification (PSC), is a security review initiative that certifies WordPress plugins for adherence to stringent security standards. The program claims to verify that plugins have been tested against common vulnerabilities, including SQL Injections, XSS Attacks, CSRF Attacks, Authentication Vulnerabilities, and Privilege Escalation Vulnerabilities.
That sounds great, doesn’t it? A program that confirms common vulnerabilities do not exist in certified plugins, and that certified plugins adhere to the stringent security standards. If it did that, that WOULD be great. In reality, you cannot trust the little PSC mark means what it implies.
Some folks dispute the program’s credibility. While CleanTalk claims the certification ensures “enhanced protection” and “stringent security standards,” independent security researchers have criticized the program for lack of rigorous actual security reviews.
Critics note that CleanTalk’s own plugins have contained basic security flaws, such as missing capability checks and improper nonce usage, which should have been detected by a genuine security audit. Consequently, some security experts advise that claims made by the program should be viewed as unreliable and that the certification may not reflect true plugin security.
Wow! A service designed to certify plugins as being safe by a company whose own plugins contain security vulnerabilities? Sounds hard to believe, right? BELIEVE IT!
After hearing about the credibility issues, we ran their Security Malware Firewall plugin, also known as Security by CleanTalk, and CleanTalk Security, through an AI analyzer to see if the critics’ claims were true. You better have a seat for this one.
According to the AI analysis, the summary read as follows: I completed a static review of the uploaded plugin. It contains 802 files, including 477 PHP files. All PHP files passed syntax checking under PHP 8.4, but I found several significant security and reliability problems.” Not one, not two, but SEVERAL.
That doesn’t sound good, but maybe it’s not too bad. To quantify that, there were six high-severity findings, ten medium-severity findings, and six lower-severity and release-quality problems. If we add that up, 6 + 10 + 6 = 22 issues. My bad, that IS bad. Really bad.
For a company that claims to certify WordPress plugins as being free of vulnerabilities, and their own security plugin has this many vulnerabilities, yet still earned a Secure certification, we believe you can see why we don’t trust this program. You shouldn’t, either.
The final result of the evaluation was rather telling. Conclusion: do not deploy this development build unchanged on a production WordPress site. Remediate and regression-test the high-severity items before considering production use.
