What is the CVSS score of CVE-2026-100518?

CVE-2026-100518 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.3%.

Advanced Google reCAPTCHA CVE-2026-100518

EUVD-2026-93069 MEDIUM

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-10-06 Patchstack

GHSA-9vfj-8pvp-mccw

WordPress Information Disclosure Google Advanced Google Recaptcha Wordpress Plugin Webfactory

5.3

CVSS 3.1 · Vendor: Patchstack

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach reCAPTCHA-protected endpoint over network
Exploit

Craft request bypassing verification logic
Execution

Submit form without valid reCAPTCHA token
Impact

Defeat anti-automation integrity control

Vulnerability Assessment

Weakness	CWE CWE-288 OWASP Top 10:2025 A07:2025 - Authentication Failures ASVS 5.0 V6 - Authentication Alternate path authentication
Exploitation Conditions	Exploitation requires that the target WordPress site has the Advanced Google reCAPTCHA plugin (version 5.40 or earlier) installed and active on a reachable form or authentication endpoint; the flaw affects the plugin's reCAPTCHA verification logic rather than the WordPress core. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, user interaction, or special privileges are needed, so there are few limiting factors beyond the plugin being present and the vulnerable version being deployed. The primary limiter is footprint: only sites running this specific plugin at <=5.40 are affected, and impact is confined to integrity of the anti-bot control (I:L) with no confidentiality or availability effect.
Impact	This is a moderate-severity (CVSS 5.3) broken-authentication flaw (CWE-288) in the Advanced Google reCAPTCHA WordPress plugin, reported by Patchstack. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated issue requiring no user interaction, but the impact is deliberately narrow: integrity-only and low (C:N/I:L/A:N), with unchanged scope. In practice this means an attacker can bypass or subvert the reCAPTCHA authentication/verification mechanism rather than take over the host - consistent with a plugin whose job is to gate forms against bots. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence, so there is no evidence of active exploitation or weaponization; this reads as a real-but-low-urgency hygiene issue rather than an emergency. One signal conflict to note: the input Tags include 'Information Disclosure', yet the CVSS vector sets C:N (no confidentiality impact) and only I:L - the labeled impact category does not match the scored impact, so the actual consequence (defeating bot/spam protection) should be confirmed against the Patchstack advisory rather than treated as data leakage.
Exploit ScenarioDerived	An unauthenticated remote attacker crafts requests to a form or endpoint protected by the Advanced Google reCAPTCHA plugin (<=5.40) and bypasses the reCAPTCHA verification step, allowing automated submissions that the plugin was meant to block. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, this requires only network access and no credentials or user interaction. No public proof-of-concept was identified in the provided data.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 06, 2026

Unauthenticated attackers can defeat the Google reCAPTCHA verification performed by the Advanced Google reCAPTCHA WordPress plugin (versions up to and including 5.40), allowing anti-bot/authentication checks on protected forms to be bypassed. The flaw is a CWE-288 authentication bypass using an alternate path or channel, rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), so no credentials, privileges, or user interaction are required and impact is limited to the integrity of the CAPTCHA control with no confidentiality or availability effect. Exploitation is constrained mainly by footprint - only WordPress sites running the vulnerable plugin version on a reachable form or authentication endpoint are affected - and no public exploit is identified at time of analysis.

RemediationAI

No vendor-released patch version is identified in the available data at time of analysis, so administrators should first check the plugin's WordPress.org page and the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/advanced-google-recaptcha/vulnerability/wordpress-advanced-google-recaptcha-plugin-5-40-broken-authentication-vulnerability) for an updated release and upgrade Advanced Google reCAPTCHA beyond 5.40 as soon as a fixed build is published. If no fix is yet available, the most direct compensating control is to deactivate the plugin, but this has the obvious side effect of removing reCAPTCHA protection from all forms and authentication endpoints it was guarding, which may expose those endpoints to automated abuse; plan to replace it with an alternative, actively maintained CAPTCHA or anti-bot plugin rather than leaving endpoints unprotected. As an interim measure, place the affected forms and WordPress login/registration endpoints behind a reverse-proxy or WAF rule that performs server-side validation of reCAPTCHA tokens or enforces rate limiting, accepting the trade-off of additional configuration complexity and possible false positives for legitimate users. Because the flaw requires no authentication and no user interaction, restricting or temporarily disabling public-facing form submissions on high-value sites (for example, disabling user registration or comment submission) is a defensible short-term step, at the cost of reduced site functionality. Monitor web and application logs for anomalous form submissions, spam registrations, or repeated CAPTCHA-failure patterns that would indicate attempted exploitation of the bypass, and re-check the Patchstack and EUVD entries for a patched plugin version.

Affected VersionsENISA

Advanced Google reCAPTCHA n/a ≤5.40

Affected Packages

euvd advanced_google_recaptcha no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The affected component is the Advanced Google reCAPTCHA plugin for WordPress, published by the vendor tracked as 'webfactory' in the CPE string cpe:2.3:a:webfactory:advanced_google_recaptcha:*:*:*:*:*:*:*:*. WordPress plugins are PHP applications that hook into WordPress actions and filters; this plugin's role is to add Google reCAPTCHA challenges to WordPress forms and authentication endpoints and to validate the resulting token server-side before allowing the protected action. CWE-288 (Authentication Bypass Using an Alternate Path or Channel) indicates the root cause is that the plugin's verification logic can be reached or satisfied through a route that does not perform the intended reCAPTCHA validation - for example, a code path where the verification result is trusted, skipped, or short-circuited - so the check that is supposed to gate the action can be circumvented without a valid reCAPTCHA response. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N confirms this is remotely reachable over the network with low complexity, requires no authentication (PR:N) and no user interaction (UI:N), and yields only a low integrity impact confined to the scope of the vulnerable component; there is no confidentiality or availability impact in the assessed vector. The CPE wildcard version and the EUVD entry EUVD-2026-93069 both identify the Advanced Google reCAPTCHA plugin at version 5.40 or earlier as the affected code base.

Know when Advanced Google Recaptcha gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Patchstack) PRIMARY 5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI 5.3 MEDIUM

Unauthenticated network-reachable verification bypass (AV:N/AC:L/PR:N/UI:N) with integrity-only low impact (I:L); no confidentiality or availability effect and unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

DescriptionCVE.org

Unauthenticated Broken Authentication in Advanced Google reCAPTCHA <= 5.40 versions.

Threat Intelligence Overview

EPSS Score

0.3%

Top 84% exploitable

Prevalence

Low

niche third-party WordPress plugin, limited site-install footprint

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.3%

Patch available No

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact· derived

Medium

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +26

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.