→ برگشت به فید آسیب‌پذیری‌ها CVE-2026-105057 · zero-spam

دور زدن محدودیت‌های امنیتی (Security Bypass) در افزونه Zero Spam for WordPress

The Zero Spam for WordPress plugin for WordPress is vulnerable to Security Feature Bypass in all versions up to, and including, 5.7.11. This is due to missing nonce and plugin-presence verification before skipping login spam checks when a WooCommerce or ProfilePress field is present in the POST request. This makes it possible for unauthenticated attackers to bypass spam and malicious-login protections on the WordPress login form by adding a crafted field to the login request, allowing unlimited login attempts without triggering blocks.