EUVD-2026-53954
GHSA-jjg8-vhcx-8xm4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running CAPTCHA 4WP
-
DeliveryLocate CAPTCHA-protected public form
-
ExploitCraft POST request omitting or spoofing verification token
-
ExecutionServer-side check accepts spoofed submission
-
PersistSubmit automated requests at scale
-
ImpactAbuse unprotected form endpoint
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Anti-spoofing controls
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions are required beyond the target site running CAPTCHA 4WP version 7.6.0 or earlier and having at least one CAPTCHA-protected form (login, registration, comment, or WooCommerce) publicly accessible. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms remote unauthenticated exploitation against default plugin configurations with no prerequisite access or interaction. Exploitation is limited to integrity impact on CAPTCHA-protected endpoints - an attacker cannot read sensitive data or cause service disruption through this vulnerability alone. The impact scope is bounded to the specific forms protected by the plugin; backend WordPress administration panels protected by other means are not directly affected. |
| Impact | The CVSS 5.3 (Medium) score reflects the realistic bounded impact: AV:N/AC:L/PR:N/UI:N confirms trivial remote unauthenticated exploitation, but S:U/C:N/I:L/A:N limits the damage to low integrity impact with no confidentiality or availability consequences. The real-world threat is automated abuse: bots bypassing account-registration throttling, credential-stuffing login pages, spamming contact forms, or exploiting WooCommerce checkout flows - all of which CAPTCHA is specifically intended to prevent. Sites that rely on CAPTCHA 4WP as a primary anti-abuse control (rather than one layer among several) face disproportionate operational risk despite the moderate CVSS score. No EPSS data was provided, no KEV listing exists, and no POC has been identified, suggesting opportunistic exploitation remains theoretical but the low attack complexity means automation of the bypass is straightforward once the technique is known. The absence of a confirmed fixed version in the available data is a meaningful gap for remediation planning. |
| Exploit ScenarioDerived | An automated script targeting a WordPress site running CAPTCHA 4WP omits or spoofs the CAPTCHA verification token in a POST request to a protected form - such as wp-login.php or a WooCommerce checkout - causing the plugin's server-side check to treat the submission as human-verified. The attacker then executes high-volume credential stuffing against the login form or bulk-registers spam accounts without triggering any CAPTCHA challenge, effectively neutralizing the site's primary bot-control mechanism. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 06, 2026
CAPTCHA 4WP WordPress plugin (versions up to and including 7.6.0) allows unauthenticated remote attackers to bypass CAPTCHA verification entirely, undermining bot-protection controls on any form the plugin secures. Classified under CWE-290 (Authentication Bypass by Spoofing), the flaw suggests the verification logic can be defeated without completing the human challenge - enabling automated abuse of protected endpoints. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector confirms trivially exploitable, zero-prerequisite network access; no public exploit code and no CISA KEV listing are identified at time of analysis.
RemediationAI
Site administrators should update CAPTCHA 4WP to a version beyond 7.6.0 via the WordPress plugin dashboard or by downloading directly from the WordPress plugin repository; the exact patched release version was not specified in the available data and should be confirmed against the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/advanced-nocaptcha-recaptcha/vulnerability/wordpress-captcha-4wp-plugin-7-6-0-captcha-bypass-vulnerability before upgrading. As a compensating control pending the patch, administrators can disable CAPTCHA 4WP and substitute an alternative anti-abuse mechanism such as server-side rate limiting (e.g., via a WAF or Cloudflare rate-limit rules) or honeypot field validation - note that these alternatives do not provide equivalent bot-detection capability. Additionally, enabling Google reCAPTCHA v3 server-side score enforcement directly at the application layer (independent of the plugin) can serve as a secondary validation layer, though this requires developer effort and carries integration complexity.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CAPTCHA 4WP (CPE: cpe:2.3:a:wpkube:captcha_4wp) is a WordPress plugin by WPKube that integrates Google reCAPTCHA and hCaptcha challenges into login, registration, comment, and WooCommerce forms. CWE-290 (Authentication Bypass by Spoofing) indicates the root cause is a failure in the server-side CAPTCHA response validation logic - typically arising when the plugin relies on client-controlled parameters (e.g., a token or flag submitted with the form) to decide whether verification was passed, rather than independently verifying the challenge response with the CAPTCHA provider's API. Such flaws allow an attacker to omit the token, replay a previous token, or supply a crafted value to make the server treat the request as verified without ever solving a challenge.
Know when Captcha 4Wp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-reachable form endpoint, no authentication or interaction required, scope unchanged, and impact limited to bypassing integrity controls on protected form submissions.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Bypass Vulnerability in CAPTCHA 4WP <= 7.6.0 versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB