Cross-Site Request Forgery Vulnerability in Kcaptcha Plugin for WordPress

CVE-2026-4121

What is CVE-2026-4121?

The Kcaptcha plugin for WordPress is susceptible to Cross-Site Request Forgery due to inadequate nonce validation in its settings page handler. Any version up to and including 1.0.1 does not implement necessary nonce fields or verification checks, allowing unauthenticated attackers to alter crucial CAPTCHA settings. This includes the ability to enable or disable CAPTCHA on login, registration, lost password, and comment forms by coaxing a site administrator into clicking a malicious link. Proper nonce fields and verification measures are essential to prevent such unauthorized actions.

References