Zero Spam for WordPress <= 5.7.12 - Missing Authorization to Unauthenticated Denial of Service via .htaccess Block Rules Refresh
- ID
- WPSEC-2026-1566
- Plugin
- Zero Spam for WordPress (zero-spam)
- Affected
- all versions before 5.7.13
- Remediation
- Update to 5.7.13 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-23
- Attack surface
- Zero Spam for WordPress on WPSec AttackSurface
- Fix released
- Published
Description
The Zero Spam for WordPress plugin for WordPress is vulnerable to unauthorized modification of data that can lead to Denial of Service due to a missing capability check and nonce verification on the .htaccess refresh functionality hooked to admin_init in all versions up to, and including, 5.7.12. This makes it possible for unauthenticated attackers to make the plugin rewrite its block rules in the site's .htaccess file by sending a request to admin-ajax.php or admin-post.php that carries the 'zerospam-refresh-htaccess' parameter. The rules are built only from blocks an administrator created, but when the IP block method is set to one of the .htaccess options (the default is PHP) and the only active blocks are location blocks, for example after the site's IP blocks have expired or been deleted, the rewrite produces a 'Deny from' or 'Require not ip' line with no address. Apache rejects that line, so every request to the site, including the WordPress admin area, fails with a server error until the .htaccess file is repaired by hand.
References
- https://wpsec.com/vuln/WPSEC-2026-1566/
- https://plugins.svn.wordpress.org/zero-spam/tags/5.7.13/
- https://wordpress.org/plugins/zero-spam/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS