Zero Spam CVE-2026-105057

The target must have the Zero Spam (by Ben Marshall) WordPress plugin installed and active at version 5.7.11 or earlier, with its anti-spam protection relied upon on a publicly reachable form/submission endpoint. Per CVSS PR:N/UI:N, no authentication or user interaction is required. The primary LIMITING factor is impact scope: the integrity-only effect (I:L, C:N, A:N) means successful exploitation defeats spam/bot filtering and permits forged or unwanted submissions, but does not itself grant data access, code execution, or site takeover - so realistic risk is bounded to spam/abuse consequences rather than full compromise.

This is a moderate-severity (CVSS 5.3) authentication/protection bypass (CWE-290) in the WordPress 'Zero Spam' plugin. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N indicates remote, low-complexity, unauthenticated exploitation requiring no user interaction, but with limited impact scoped only to integrity (C:N/I:L/A:N) - meaning no data disclosure and no denial of service, only a low-integrity effect consistent with defeating the plugin's anti-spam enforcement. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT listed in CISA KEV and no public exploit code is referenced, so there is no public exploit identified at time of analysis. The practical risk is therefore low-to-moderate: although the flaw is trivially reachable and unauthenticated, its consequence is the failure of a spam-mitigation control rather than compromise of the host site, which caps real-world impact. Note a slight framing nuance: CWE-290 (Authentication Bypass by Spoofing) combined with the product name suggests the 'bypass' is of the plugin's spam/bot-detection logic rather than of WordPress user authentication - defenders should not read this as a site-takeover or login bypass. Key missing data: no EPSS, no vendor-confirmed patched version, and no POC status beyond the single Patchstack reference.

A remote, unauthenticated attacker crafts requests to a form or submission endpoint on a WordPress site running Zero Spam ≤ 5.7.11 and structures them to evade the plugin's spam/bot detection logic. This allows automated spam, forged comments, or bot submissions to pass through controls the site operator believed were blocking them. No public proof-of-concept exploit is referenced, and exploitation is low-complexity but limited to defeating the anti-spam control rather than compromising the host.