Web-Art Login Shield with reCAPTCHA <= 1.2.2 - Unauthenticated reCAPTCHA and Login Protect Bypass via 'action' Parameter
- ID
- WPSEC-2026-0153
- Plugin
- Web-Art Login Shield with reCAPTCHA (webart-login-shield-recaptcha)
- Affected
- all versions before 1.2.3
- Remediation
- Update to 1.2.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-178
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Web-Art Login Shield with reCAPTCHA on WPSec AttackSurface
- Fix released
- Published
Description
The Web-Art Login Shield with reCAPTCHA plugin for WordPress is vulnerable to a protection mechanism bypass via the 'action' parameter in all versions up to, and including, 1.2.2. The lgre_is_wp_login_post_attempt() function normalized the submitted action with sanitize_key(), which lowercases it and strips characters, before comparing it against a list of non-login actions such as register and lostpassword. WordPress core compares the action exactly and treats an unrecognized value as a normal login, so a value such as 'Register' was processed by core as a login but skipped by the plugin. This makes it possible for unauthenticated attackers to submit wp-login.php login attempts that bypass reCAPTCHA verification and Login Protect attempt limiting, which enables unthrottled password guessing.
References
- https://wpsec.com/vuln/WPSEC-2026-0153/
- https://plugins.svn.wordpress.org/webart-login-shield-recaptcha/tags/1.2.3/
- https://wordpress.org/plugins/webart-login-shield-recaptcha/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS