Cross-Site Request Forgery Vulnerability in ZT Captcha Plugin for WordPress

CVE-2026-1075

What is CVE-2026-1075?

The ZT Captcha plugin for WordPress exhibits a vulnerability that allows unauthenticated attackers to exploit improper nonce validation on specific actions. This occurs in all versions up to and including 1.0.4, where an empty token can bypass nonce checks. By tricking site administrators into executing a forged action, attackers can alter the plugin's settings, which potentially compromises the security of the WordPress site.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References