Web-Art Login Shield with reCAPTCHA <= 1.2.2 - Unauthenticated Login Protect Bypass via Race Condition
- ID
- WPSEC-2026-0152
- Plugin
- Web-Art Login Shield with reCAPTCHA (webart-login-shield-recaptcha)
- Affected
- all versions before 1.2.3
- Remediation
- Update to 1.2.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-362
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Web-Art Login Shield with reCAPTCHA on WPSec AttackSurface
- Fix released
- Published
Description
The Web-Art Login Shield with reCAPTCHA plugin for WordPress is vulnerable to a Login Protect attempt-limit bypass via a race condition in all versions up to, and including, 1.2.2. The lgre_prepare_login_protect_request() function reserved a slot for every in-flight authentication but did not count those reservations toward the configured maximum, and a request that had passed this check was not re-checked against a lockout set by a concurrent request, including during REST Application Password authentication. This makes it possible for unauthenticated attackers to send many concurrent login requests from one IP address and have each password checked, exceeding the configured failed-login limit before the lockout takes effect.
References
- https://wpsec.com/vuln/WPSEC-2026-0152/
- https://plugins.svn.wordpress.org/webart-login-shield-recaptcha/tags/1.2.3/
- https://wordpress.org/plugins/webart-login-shield-recaptcha/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS