Captcha Code CVE-2026-94457

Exploitation requires the target WordPress site to have the Captcha Code plugin (by webfactory) version 3.32 or earlier installed and actively enforcing CAPTCHA on one or more forms. No authentication or user interaction is needed (PR:N/UI:N), but the CVSS AC:H rating indicates non-trivial conditions - the attacker must successfully craft or replay input that defeats the plugin's specific verification logic, which is not guaranteed to succeed on every attempt. The impact is limited to bypassing the anti-automation control itself; it does not grant WordPress account access, so its practical value depends on the sensitivity of the forms the CAPTCHA was protecting.

This is a genuinely low-priority issue despite the 'authentication bypass' framing. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, base 4.8) correctly reflects that while the flaw is remotely reachable without authentication, it carries high attack complexity and only low confidentiality/integrity impact with no availability impact. CWE-290 (Authentication Bypass by Spoofing) combined with the product being a CAPTCHA plugin strongly indicates this is a CAPTCHA-verification bypass - defeating the anti-automation control on forms - rather than a bypass of WordPress user authentication itself. The realistic consequence is enabling downstream abuse (spam submissions, credential-stuffing/brute-force against protected forms, automated posting), which explains the low C/I and null A. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept in the provided data, so exploitation is unproven. No SSVC decision data was supplied. The only source is a single Patchstack advisory. Net: this is a low-CVSS, low-real-risk defense-in-depth degradation, not an urgent patch - no conflicting signals, but note the vendor CVSS base score of 4.8 is the sole quantitative input and no SSVC/EPSS corroboration exists.

A remote unauthenticated attacker crafts requests to a WordPress site running Captcha Code <= 3.32 that defeat or replay the plugin's CAPTCHA validation, allowing automated form submissions to pass as if the CAPTCHA were solved. This turns a protected login, comment, or registration form back into an unprotected one, enabling spam floods or brute-force attempts. No public exploit code is identified at time of analysis, and the CVSS AC:H rating suggests the bypass is not trivially reliable.