CVE-2026-1075: ZT Captcha WordPress Plugin CSRF Vulnerability

CVE-2026-1075 Overview

The ZT Captcha plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability in all versions up to and including 1.0.4. The vulnerability stems from improper nonce validation on the save_ztcpt_captcha_settings action, where the nonce check can be bypassed by sending an empty token value. This security flaw enables unauthenticated attackers to modify the plugin's settings through a forged request, provided they can trick a site administrator into performing an action such as clicking on a malicious link.

Critical Impact

Unauthenticated attackers can manipulate ZT Captcha plugin settings via CSRF, potentially disabling CAPTCHA protection on WordPress forms and enabling automated attacks such as spam, credential stuffing, or brute-force login attempts.

Affected Products

• ZT Captcha Plugin for WordPress versions up to and including 1.0.4
• WordPress installations with vulnerable ZT Captcha plugin versions

Discovery Timeline

• 2026-01-24 - CVE-2026-1075 published to NVD
• 2026-01-26 - Last updated in NVD database

Technical Details for CVE-2026-1075

Vulnerability Analysis

This CSRF vulnerability exists due to a fundamental flaw in the nonce validation logic within the ZT Captcha plugin. WordPress nonces are security tokens designed to protect against CSRF attacks by validating that requests originate from the legitimate site. However, the implementation in the save_ztcpt_captcha_settings action contains a critical weakness: it fails to properly validate empty token values.

When an attacker sends a request with an empty nonce parameter, the validation check is bypassed entirely. This allows the attacker to craft malicious requests that, when triggered by an authenticated administrator, will modify the plugin's configuration settings without proper authorization verification.

The attack requires user interaction—specifically, an administrator must be tricked into clicking a malicious link or visiting a crafted webpage while authenticated to the WordPress site. Once triggered, the attacker can modify CAPTCHA settings, potentially disabling CAPTCHA protection across the site.

Root Cause

The root cause is improper nonce validation in the CaptchaRequest.php file at approximately line 37. The plugin fails to reject requests containing empty or null nonce values, allowing the security check to be bypassed. Proper nonce validation should verify that the token exists, is non-empty, and matches the expected value using WordPress's wp_verify_nonce() function with strict checking enabled.

Attack Vector

The attack is network-based and requires user interaction. An attacker would craft a malicious HTML page or link containing a forged request to the vulnerable endpoint. The attacker then needs to convince an authenticated WordPress administrator to visit this malicious content. When the administrator's browser loads the crafted content, it automatically submits the forged request to the WordPress site, modifying the ZT Captcha settings.

The vulnerability mechanism is documented in the WordPress Plugin Code Review, which shows the specific location of the improper nonce validation. The Wordfence Vulnerability Report provides additional technical details about the exploitation requirements.

Detection Methods for CVE-2026-1075

Indicators of Compromise

• Unexpected changes to ZT Captcha plugin settings without administrator action
• CAPTCHA functionality suddenly disabled on WordPress forms
• Suspicious entries in WordPress access logs showing POST requests to save_ztcpt_captcha_settings action
• Referrer headers from external domains in requests to the settings endpoint

Detection Strategies

• Monitor WordPress admin-ajax.php for suspicious requests to save_ztcpt_captcha_settings action with empty or missing nonce parameters
• Implement Web Application Firewall (WAF) rules to detect CSRF patterns targeting ZT Captcha endpoints
• Enable WordPress audit logging to track plugin setting modifications and correlate with administrator session activity
• Review server access logs for unusual POST requests originating from unexpected referrer domains

Monitoring Recommendations

• Configure alerts for any changes to ZT Captcha plugin configuration, especially when performed outside normal administrative hours
• Implement file integrity monitoring on plugin configuration files and database options
• Monitor for increases in spam submissions or failed CAPTCHA validations that may indicate disabled protection
• Deploy SentinelOne Singularity XDR for comprehensive endpoint visibility and automated threat detection

How to Mitigate CVE-2026-1075

Immediate Actions Required

• Update the ZT Captcha plugin to a patched version beyond 1.0.4 when available
• Temporarily deactivate the ZT Captcha plugin if a patch is not yet released and replace with an alternative CAPTCHA solution
• Verify current ZT Captcha settings have not been tampered with and reset to secure defaults if necessary
• Educate administrators about phishing risks and avoiding clicking unknown links while authenticated to WordPress

Patch Information

Check the WordPress Plugin Repository for updated versions of the ZT Captcha plugin that address this nonce validation vulnerability. The Wordfence Vulnerability Report may contain additional patching guidance and timeline information.

Workarounds

• Implement a Web Application Firewall (WAF) rule to block requests to save_ztcpt_captcha_settings with empty nonce parameters
• Use browser-based security extensions that warn administrators about potential CSRF attacks
• Restrict access to WordPress admin panel by IP address or VPN to limit attacker opportunities
• Consider using alternative CAPTCHA plugins with better security track records until a fix is available

# WordPress wp-config.php hardening
# Add CSRF protection headers via .htaccess
<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
    Header set X-Frame-Options "SAMEORIGIN"
    Header set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

# Block suspicious requests to vulnerable endpoint (temporary mitigation)
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_METHOD} POST
    RewriteCond %{QUERY_STRING} action=save_ztcpt_captcha_settings [NC]
    RewriteCond %{HTTP_REFERER} !^https?://(www\.)?yourdomain\.com [NC]
    RewriteRule ^ - [F,L]
</IfModule>