Captcha Code Authentication Vulnerabilities

The Captcha Code plugin for WordPress is vulnerable to Bypass Vulnerability in all versions up to, and including, 3.32. This is due to use of the login_redirect filter to enforce captcha validation after authentication succeeds rather than the authenticate filter, allowing authentication to complete before the captcha...

CVSS:

5.3

(Wordfence)

Affected:

up to 3.32

Fixed in:

3.33

Disclosed:

Sep 23, 2026

CVE-2026-94457 on NVD →

The Captcha Code plugin for WordPress is vulnerable to CAPTCHA Bypass in versions up to, and including, 2.9. This makes it possible for unauthenticated attackers to bypass the Captcha Verification.

CVSS:

5.3

(Wordfence)

Affected:

up to 2.9

Fixed in:

3.0

Disclosed:

Nov 24, 2023

CVE-2023-48745 on NVD →

The Captcha Code plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7. This is due to missing or incorrect nonce validation on the wp_captcha_general_options function. This makes it possible for unauthenticated attackers to update plugin settings, via forged request gra...

CVSS:

8.8

(Wordfence)

Affected:

up to 2.7

Fixed in:

2.8

Disclosed:

Sep 1, 2022

CVE-2022-37411 on NVD →