WP Captcha PRO <= 5.40 - Unauthenticated Login CAPTCHA and Lockout Bypass for Incorrect Passwords
- ID
- WPSEC-2026-0394
- Plugin
- Advanced Google reCAPTCHA (advanced-google-recaptcha)
- Affected
- from 1.33 before 5.41
- Remediation
- Update to 5.41 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-307
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- WP Captcha PRO on WPSec AttackSurface
- Fix released
- Published
Description
The Advanced Google reCAPTCHA (WP Captcha) plugin for WordPress is vulnerable to a brute-force protection bypass in versions 1.33 up to, and including, 5.40. The plugin ran its login CAPTCHA and lockout checks after WordPress core had already verified the password, and returned core's error unchanged whenever the password was wrong. Failed login attempts were therefore never checked for a CAPTCHA and never triggered the IP lockout, while a correct password produced a different error. This makes it possible for unauthenticated attackers to guess account passwords without solving the CAPTCHA and without being locked out.
References
- https://wpsec.com/vuln/WPSEC-2026-0394/
- https://plugins.svn.wordpress.org/advanced-google-recaptcha/tags/5.41/
- https://wordpress.org/plugins/advanced-google-recaptcha/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS