# Zero Spam for WordPress <= 5.7.12 - Missing Authorization to Unauthenticated Denial of Service via .htaccess Block Rules Refresh

- **ID:** WPSEC-2026-1566
- **Plugin:** Zero Spam for WordPress (`zero-spam`), https://wordpress.org/plugins/zero-spam/
- **Affected versions:** all versions before 5.7.13
- **Fixed in:** 5.7.13 (Update to 5.7.13 or later.)
- **Severity:** Medium 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-23)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/zero-spam
- **Fix released:** 2026-10-22
- **Published:** 2026-10-23
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1566/

## Description

The Zero Spam for WordPress plugin for WordPress is vulnerable to unauthorized modification of data that can lead to Denial of Service due to a missing capability check and nonce verification on the .htaccess refresh functionality hooked to admin_init in all versions up to, and including, 5.7.12. This makes it possible for unauthenticated attackers to make the plugin rewrite its block rules in the site's .htaccess file by sending a request to admin-ajax.php or admin-post.php that carries the 'zerospam-refresh-htaccess' parameter. The rules are built only from blocks an administrator created, but when the IP block method is set to one of the .htaccess options (the default is PHP) and the only active blocks are location blocks, for example after the site's IP blocks have expired or been deleted, the rewrite produces a 'Deny from' or 'Require not ip' line with no address. Apache rejects that line, so every request to the site, including the WordPress admin area, fails with a server error until the .htaccess file is repaired by hand.

## References

- https://wpsec.com/vuln/WPSEC-2026-1566/
- https://plugins.svn.wordpress.org/zero-spam/tags/5.7.13/
- https://wordpress.org/plugins/zero-spam/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1566/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.