CVE-2026-100518 Overview
CVE-2026-100518 is a broken authentication vulnerability affecting the Advanced Google reCAPTCHA WordPress plugin in versions up to and including 5.40. The flaw allows unauthenticated remote attackers to bypass authentication controls enforced by the plugin over the network without user interaction. The weakness is classified under CWE-288, Authentication Bypass Using an Alternate Path or Channel. Because the plugin is intended to block automated and credential-based attacks against WordPress login flows, a bypass directly weakens the authentication posture of any site that relies on it.
Critical Impact
Unauthenticated attackers can bypass authentication protections provided by the Advanced Google reCAPTCHA plugin, enabling downstream credential attacks against WordPress logins.
Affected Products
- Advanced Google reCAPTCHA WordPress plugin, versions <= 5.40
- WordPress sites relying on the plugin to protect login, registration, or comment forms
- Any multisite deployment where the plugin is network-activated
Discovery Timeline
- 2026-10-06 - CVE-2026-100518 published to NVD
- 2026-10-06 - Last updated in NVD database
Technical Details for CVE-2026-100518
Vulnerability Analysis
The vulnerability resides in the authentication path enforced by the Advanced Google reCAPTCHA plugin. The plugin is designed to challenge requests against WordPress authentication endpoints with Google reCAPTCHA verification. Under this flaw, an alternate request path reaches the authentication handler without triggering the reCAPTCHA validation step. Attackers do not need credentials, privileges, or user interaction to reach the vulnerable code. The impact is limited to integrity of the authentication control itself; confidentiality and availability of the WordPress host are not directly affected by the bypass. However, removing the reCAPTCHA gate exposes the underlying wp-login.php and related endpoints to brute-force and credential stuffing attacks they were previously throttling.
Root Cause
The root cause maps to CWE-288: the plugin fails to apply the reCAPTCHA verification uniformly across all request paths that reach its authentication handler. One or more alternate channels, such as unexpected request parameters, HTTP methods, or legacy endpoints, bypass the challenge. Patchstack describes the issue as broken authentication in the plugin logic. See the Patchstack Vulnerability Report for vendor-confirmed technical specifics.
Attack Vector
An unauthenticated remote attacker sends crafted HTTP requests to the WordPress site over the network. The requests exercise the alternate path that bypasses the reCAPTCHA verification. Once the challenge is skipped, the attacker can submit high-volume authentication attempts against WordPress login endpoints without triggering the human-verification control. No social engineering, user interaction, or prior access is required.
No verified public exploit code is available at this time. For technical specifics, consult the Patchstack Vulnerability Report.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-100518
Indicators of Compromise
- Elevated volumes of POST requests to wp-login.php, xmlrpc.php, or custom login endpoints without corresponding reCAPTCHA token submissions in logs
- Successful or failed login events in WordPress logs that lack an associated reCAPTCHA validation entry from the plugin
- Repeated authentication attempts from a small set of source IP addresses sharing identical User-Agent strings
Detection Strategies
- Compare the ratio of login attempts to reCAPTCHA verification events; a divergence indicates the challenge is being bypassed
- Inspect web server access logs for requests that reach authentication handlers via non-standard parameters or HTTP methods
- Correlate failed login spikes with absence of outbound calls to www.google.com/recaptcha/api/siteverify
Monitoring Recommendations
- Alert on brute-force patterns targeting /wp-login.php and REST authentication routes
- Monitor plugin version inventory across WordPress fleets and flag any instance running Advanced Google reCAPTCHA <= 5.40
- Forward WordPress and WAF logs to a centralized analytics platform for cross-site correlation of credential-stuffing campaigns
How to Mitigate CVE-2026-100518
Immediate Actions Required
- Update the Advanced Google reCAPTCHA plugin to the version released after 5.40 as published by the vendor
- Audit WordPress administrator and editor accounts for unexpected logins, new users, or privilege changes
- Enforce strong, unique passwords and enable multi-factor authentication on all privileged accounts
Patch Information
Refer to the Patchstack Vulnerability Report for the fixed version and vendor advisory. Apply the plugin update through the WordPress admin dashboard or via WP-CLI across all affected sites.
Workarounds
- Deploy a web application firewall rule to rate-limit requests against wp-login.php and xmlrpc.php until the plugin is updated
- Restrict access to WordPress authentication endpoints by source IP where operationally feasible
- Disable the Advanced Google reCAPTCHA plugin and substitute an alternative challenge mechanism until a patched version is deployed
# Update the plugin using WP-CLI once a fixed version is available
wp plugin update advanced-google-recaptcha --all
wp plugin list --name=advanced-google-recaptcha --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
