CVE-2026-94457: Captcha Code Auth Bypass Vulnerability

CVE-2026-94457 Overview

CVE-2026-94457 is an unauthenticated bypass vulnerability affecting the Captcha Code WordPress plugin in versions 3.32 and earlier. The flaw is classified under [CWE-290] Authentication Bypass by Spoofing. An unauthenticated attacker can circumvent the CAPTCHA verification logic without solving the challenge, defeating the anti-automation control the plugin provides to WordPress site owners.

Because the plugin is typically deployed on login, registration, and comment forms, a successful bypass exposes those endpoints to automated abuse. This includes credential stuffing, spam submission, and account enumeration workflows that CAPTCHA was intended to slow or block.

Critical Impact
Attackers can defeat the CAPTCHA control on protected WordPress forms without authentication, enabling automated abuse of login, registration, and comment endpoints.

Affected Products

Captcha Code Authentication plugin for WordPress, versions <= 3.32
WordPress sites relying on the plugin for form-level bot mitigation
Any downstream workflows (login, registration, comments, contact forms) protected by the plugin

Discovery Timeline

2026-09-23 - CVE-2026-94457 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-94457

Vulnerability Analysis

The vulnerability is an authentication-adjacent bypass in the Captcha Code plugin's challenge validation path. According to the Patchstack WordPress Vulnerability advisory, affected versions do not correctly enforce that a submitted CAPTCHA response matches a valid, server-issued challenge. This maps to [CWE-290], where an attacker spoofs an authentication artifact to gain trust.

Exploitation requires no credentials and no user interaction. The attack surface is network-reachable over standard HTTP or HTTPS to the WordPress site. The impact is limited in scope: the CAPTCHA control itself is defeated, but the vulnerability does not directly grant code execution or administrative access. The practical risk arises when the bypass is chained with weak passwords, exposed registration flows, or spam-sensitive endpoints.

Root Cause

The root cause is improper validation of the CAPTCHA response against server-side state. When the plugin fails to bind the submitted response to a unique, session-tied challenge, an attacker can submit a crafted or reused value that the plugin accepts as valid.

Attack Vector

An attacker sends a crafted HTTP POST request to a form protected by the plugin. The request omits or forges the CAPTCHA parameter in a way the plugin still treats as successful validation. Refer to the Patchstack advisory linked above for the specific parameter behavior and reproduction detail.

// No verified proof-of-concept code is published for CVE-2026-94457.
// See the Patchstack advisory for technical validation detail.

Detection Methods for CVE-2026-94457

Indicators of Compromise

Spikes in successful form submissions from a small number of source IPs or user-agent strings against wp-login.php, wp-comments-post.php, or registration endpoints
Form submissions where the CAPTCHA parameter is missing, empty, or reuses the same value across many requests
Sudden increase in newly registered accounts, comment spam, or failed login attempts on sites running the Captcha Code plugin

Detection Strategies

Review web server and WordPress access logs for high-volume POST activity to plugin-protected endpoints correlated with low CAPTCHA challenge issuance
Enable WordPress audit logging to correlate form submissions with authentication outcomes and new account creation
Inspect the plugin version in use across managed WordPress sites and flag any instance at 3.32 or earlier

Monitoring Recommendations

Alert on repeated POSTs to authentication endpoints from a single source without matching CAPTCHA GET requests
Monitor for anomalous registration or comment submission rates that deviate from baseline
Forward WordPress and web server logs to a centralized analytics platform for correlation and long-window review

How to Mitigate CVE-2026-94457

Immediate Actions Required

Inventory all WordPress sites and identify installations of the Captcha Code Authentication plugin at version 3.32 or below
Update the plugin to a version above 3.32 as soon as the vendor-supplied fix is available
Temporarily disable the plugin on high-risk endpoints if a patched version is not yet installable

Patch Information

Refer to the Patchstack WordPress Vulnerability advisory for the fixed version and vendor guidance. Apply the update through the WordPress admin plugin manager or via managed WordPress tooling.

Workarounds

Deploy a Web Application Firewall (WAF) rule to require and validate the CAPTCHA parameter on protected forms
Add rate limiting and IP reputation filtering in front of wp-login.php, registration, and comment endpoints
Replace the plugin with an alternative CAPTCHA solution until a fixed version is deployed

bash

# Example: identify vulnerable plugin installs via WP-CLI
wp plugin get captcha-code-authentication --field=version
wp plugin update captcha-code-authentication