What is the CVSS score of EUVD-2026-53954?

EUVD-2026-53954 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

CAPTCHA 4WP EUVD-2026-53954

| CVE-2026-32469 MEDIUM

Authentication Bypass by Spoofing (CWE-290)

2026-08-06 Patchstack

GHSA-jjg8-vhcx-8xm4

WordPress Authentication Bypass Wordpress Plugin Captcha 4Wp Wpkube

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable form endpoint, no authentication or interaction required, scope unchanged, and impact limited to bypassing integrity controls on protected form submissions.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 16:00 vuln.today

DescriptionCVE.org

Unauthenticated Bypass Vulnerability in CAPTCHA 4WP <= 7.6.0 versions.

AnalysisAI

CAPTCHA 4WP WordPress plugin (versions up to and including 7.6.0) allows unauthenticated remote attackers to bypass CAPTCHA verification entirely, undermining bot-protection controls on any form the plugin secures. Classified under CWE-290 (Authentication Bypass by Spoofing), the flaw suggests the verification logic can be defeated without completing the human challenge - enabling automated abuse of protected endpoints. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector confirms trivially exploitable, zero-prerequisite network access; no public exploit code and no CISA KEV listing are identified at time of analysis.

Technical ContextAI

CAPTCHA 4WP (CPE: cpe:2.3:a:wpkube:captcha_4wp) is a WordPress plugin by WPKube that integrates Google reCAPTCHA and hCaptcha challenges into login, registration, comment, and WooCommerce forms. CWE-290 (Authentication Bypass by Spoofing) indicates the root cause is a failure in the server-side CAPTCHA response validation logic - typically arising when the plugin relies on client-controlled parameters (e.g., a token or flag submitted with the form) to decide whether verification was passed, rather than independently verifying the challenge response with the CAPTCHA provider's API. Such flaws allow an attacker to omit the token, replay a previous token, or supply a crafted value to make the server treat the request as verified without ever solving a challenge.

RemediationAI

Site administrators should update CAPTCHA 4WP to a version beyond 7.6.0 via the WordPress plugin dashboard or by downloading directly from the WordPress plugin repository; the exact patched release version was not specified in the available data and should be confirmed against the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/advanced-nocaptcha-recaptcha/vulnerability/wordpress-captcha-4wp-plugin-7-6-0-captcha-bypass-vulnerability before upgrading. As a compensating control pending the patch, administrators can disable CAPTCHA 4WP and substitute an alternative anti-abuse mechanism such as server-side rate limiting (e.g., via a WAF or Cloudflare rate-limit rules) or honeypot field validation - note that these alternatives do not provide equivalent bot-detection capability. Additionally, enabling Google reCAPTCHA v3 server-side score enforcement directly at the application layer (independent of the plugin) can serve as a secondary validation layer, though this requires developer effort and carries integration complexity.