Zero Spam < 5.7.12 - Unauthenticated Spam Protection Bypass on Login

Description

The plugin is vulnerable to Security Feature Bypass due to missing nonce and plugin-presence verification before skipping login spam checks when a WooCommerce or ProfilePress field is present in the POST request. This makes it possible for unauthenticated attackers to bypass spam and malicious-login protections on the WordPress login form by adding a crafted field to the login request, allowing unlimited login attempts without triggering blocks.