EUVD-2026-38669
GHSA-r3xp-pqgc-3wvf
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
PR:N because attacker needs no site credentials; A:L added over provided vector because plugin uninstall and log deletion constitute partial availability loss of the plugin's security and audit functions.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Blue Captcha plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 2.0.1. This is due to missing or incorrect nonce validation on the main admin panel (blcap_main_page) and on the Hall of Shame and Log subpages, which accept a 'blcap_action' / 'action' parameter from $_REQUEST and perform destructive operations (plugin uninstall via blcap_uninstall(), log deletion via blcap_delete_logs(), Hall of Shame deletion via blcap_delete_ip_db(), and adding IPs to the banned list via update_option('blcap_settings')) with no wp_verify_nonce(), check_admin_referer(), or check_ajax_referer() calls anywhere in the codebase. This makes it possible for unauthenticated attackers to uninstall the plugin, delete audit logs, remove Hall of Shame entries, and add arbitrary IP addresses to the block list via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
AnalysisAI
Cross-Site Request Forgery in the Blue Captcha WordPress plugin (versions ≤ 2.0.1) allows unauthenticated attackers to trigger destructive administrative operations - including plugin uninstall, audit log deletion, Hall of Shame wipe, and arbitrary IP blocklist manipulation - by tricking a logged-in administrator into clicking a crafted link. The root cause is a complete absence of nonce validation (wp_verify_nonce, check_admin_referer, check_ajax_referer) across all admin handler entry points, confirmed by Wordfence with direct source code references. No public exploit has been identified at time of analysis, and no patched version has been confirmed.
Technical ContextAI
The affected product is the Blue Captcha plugin for WordPress developed by Jotis, identified by CPE cpe:2.3:a:jotis:blue_captcha:*:*:*:*:*:*:*:* through version 2.0.1. The vulnerability class is CWE-352 (Cross-Site Request Forgery), which arises when state-changing HTTP requests lack a secret, session-bound token tying them to the legitimate user. WordPress provides three canonical nonce-protection mechanisms - wp_verify_nonce(), check_admin_referer(), and check_ajax_referer() - none of which appear anywhere in the plugin codebase according to Wordfence's analysis. The admin handler blcap_main_page and sub-pages (Hall of Shame via bluehos.php, Log via bluelog.php) all consume the blcap_action or action parameter from PHP's $_REQUEST superglobal - which merges GET, POST, and COOKIE data - and dispatch directly to destructive functions: blcap_uninstall(), blcap_delete_logs(), blcap_delete_ip_db(), and update_option('blcap_settings'). The specific vulnerable lines are confirmed at bluecaptcha.php#L220-L221, bluehos.php#L51, bluehos.php#L91, and bluelog.php#L62.
RemediationAI
No vendor-released patch has been identified at time of analysis; the fix version is unknown and not stated in the Wordfence advisory or any other available reference. WordPress administrators running Blue Captcha 2.0.1 or earlier should consider deactivating and removing the plugin until a patched release is confirmed - plugin removal eliminates the attack surface entirely, though it also removes CAPTCHA protection and should be weighed accordingly. As a compensating control, restricting wp-admin access to trusted IP ranges (via web server or WAF rules) significantly reduces the feasibility of the social-engineering step by limiting which sessions an attacker can target. Enforcing SameSite=Strict or SameSite=Lax cookie attributes on WordPress authentication cookies (available via security plugins or server configuration) provides a browser-level CSRF barrier for modern browsers, but does not fix the underlying code defect. Monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/793072e9-250b-4a2c-819f-aa7e1dc7d4d6 and the WordPress plugin repository for any updated release.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today