What the vulnerability does
01Description
The Kcaptcha plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.0.1. This is due to missing nonce validation in the plugin's settings page handler (admin/setting.php). The settings form does not include a wp_nonce_field() and the form processing code does not call wp_verify_nonce() or check_admin_referer() before saving settings to the database via $wpdb->update(). This makes it possible for unauthenticated attackers to modify the plugin's CAPTCHA settings (enabling or disabling CAPTCHA on login, registration, lost password, and comment forms) via a forged request, granted they can trick a site administrator into performing an action such as clicking a link.
Explanation of Vulnerability in Simple Terms
02Summary
Kcaptcha versions 1.0.1 and earlier are vulnerable to cross-site request forgery (CSRF) attacks. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions on the site without their knowledge. The vulnerability requires user interaction—the admin must visit the attacker's page—but can modify site data or settings.
What an attacker can do
03Attacker Capabilities
Trick a site admin into visiting a malicious page that performs unwanted actions on the site.
Potential impact on your site
04Site Impact
An attacker can modify site settings or data by tricking administrators into visiting malicious pages.
Conditions required to exploit
05Prerequisites
The site admin must be logged in and visit an attacker-controlled webpage.
Key dates
06Disclosure timeline
April 22, 2026
CVE published
April 23, 2026
Record updated
