Description

WordPress Plugin WM Simple Captcha is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to perform otherwise restricted actions and subsequently bypass captcha validation for new registrations. WordPress Plugin WM Simple Captcha version 2.0.3 is vulnerable; prior versions may also be affected.

Remediation

Disable the plugin until a fix is available

References

https://wordpress.org/support/topic/easily-bypassed-vulnerable/

Related Vulnerabilities

TYPO3 Deserialization of Untrusted Data Vulnerability (CVE-2020-15098)

WordPress Plugin Login as User or Customer Privilege Escalation (3.2)

WordPress Plugin Business Directory-Easy Listing Directories for WordPress Multiple Vulnerabilities (5.11.1)

WordPress Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2008-0616)

Joomla Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-12766)

Severity

High

Classification

CWE-264 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update Authentication Bypass