Captcha by BestWebSoft CVE-2026-39772

The target must be a WordPress site running the Captcha by BestWebSoft plugin at version 5.2.8 or earlier, with the plugin active on at least one public-facing form (login, comment, registration, or password reset) for the bypass to have meaningful effect. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation is remote, low-complexity, unauthenticated, and requires no user interaction against default configurations where the plugin protects a form. The practical limit on impact is that only integrity is affected (I:L): bypassing the captcha does not itself grant access or data - it merely removes the anti-automation control, so real-world damage depends on what the exposed form is protected against and whether other rate-limiting or authentication layers exist.

This is a low-to-moderate priority issue despite being network-exploitable without authentication. The CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) reflects an unauthenticated, low-complexity remote vector but with impact limited to integrity only (I:L) and no confidentiality or availability consequence - consistent with CWE-290 (Authentication Bypass by Spoofing), where the captcha control is defeated rather than the host system compromised. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence, so there is no signal of active or probable exploitation; the single Patchstack reference indicates coordinated disclosure rather than observed attacks. The realistic consequence is that the captcha protection on forms (login, comment, registration, password reset) can be bypassed, re-enabling automated abuse such as spam, credential stuffing, and brute-force attempts that the plugin is meant to block - a defense-in-depth weakening rather than a direct breach. In short, this is a genuine but contained weakness: the unauthenticated network vector warrants timely patching on exposed WordPress sites, but the low integrity-only impact and absence of exploitation signals mean it is not an emergency relative to higher-severity, actively-exploited flaws.

An attacker targets a WordPress site running Captcha by BestWebSoft 5.2.8 or earlier and crafts requests to a protected form (such as login or comment submission) that bypass the captcha verification step, submitting without solving the challenge. This re-enables automation against the form, allowing high-volume spam, comment flooding, or brute-force/credential-stuffing attempts that the captcha was intended to stop. No public exploit code was identified at time of analysis, and the low-complexity unauthenticated vector means the attack can be scripted once the bypass technique is understood.