Captcha By Bestwebsoft
Monthly
Captcha bypass in the WordPress plugin Captcha by BestWebSoft (versions 5.2.8 and earlier) lets unauthenticated remote attackers defeat the plugin's anti-automation challenge on any form it protects, including login, registration, comment and password reset, without user interaction. Classified as CWE-290 (authentication bypass by spoofing) and scored CVSS 5.3, the issue degrades only integrity of the protected workflow: bypassing the captcha removes a defense-in-depth control but does not itself grant account access or expose data. No public exploit identified at time of analysis, and real-world severity depends on which forms the plugin guards and whether separate rate-limiting, MFA or WAF controls are active.
Captcha bypass in the WordPress plugin Captcha by BestWebSoft (versions 5.2.8 and earlier) lets unauthenticated remote attackers defeat the plugin's anti-automation challenge on any form it protects, including login, registration, comment and password reset, without user interaction. Classified as CWE-290 (authentication bypass by spoofing) and scored CVSS 5.3, the issue degrades only integrity of the protected workflow: bypassing the captcha removes a defense-in-depth control but does not itself grant account access or expose data. No public exploit identified at time of analysis, and real-world severity depends on which forms the plugin guards and whether separate rate-limiting, MFA or WAF controls are active.