The Zero Spam plugin contains an improper authentication weakness (CWE‑290), which allows any unauthenticated visitor to bypass the plugin’s spam detection logic. Because the plugin is intended to filter user submissions, a bypass can let spam content or potentially malicious content reach the site without being flagged. This can diminish the integrity of user input and may lead to further attacks if the plugin also provides any administrative or configuration functions.

Ben Marshall: Zero Spam, all versions up to and including 5.7.11. The vulnerability applies to the WordPress plugin installed on any WordPress site that uses one of those affected versions. No specific WordPress core version is mentioned, so any WordPress installation hosting this plugin is potentially impacted.

The installed CVSS score of 5.3 indicates a moderate level of risk. The EPSS score is 0.00315 (approximately 0.3%), and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by sending crafted HTTP requests to the plugin’s endpoints without authentication. Because no authentication is required, automated scanners or malicious actors could abuse the bypass to inject spam or otherwise undermine the plugin’s purpose.