CVE-2026-100518 - Vulnerability Details - OpenCVE

Unauthenticated Broken Authentication in Advanced Google reCAPTCHA <= 5.40 versions.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Webfactoryltd	Advanced Google Recaptcha
Wordpress-extensions	Advanced Google Recaptcha

No data.

No data.

References

Link	Providers
https://patchstack.com/database/wordpress/plugin/advanced-google-recaptcha/vulnerability/wordpress-advanced-google-recaptcha-plugin-5-40-broken-authentication-vulnerability?_s_id=cve

History

Tue, 06 Oct 2026 21:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Webfactoryltd Webfactoryltd advanced Google Recaptcha Wordpress-extensions Wordpress-extensions advanced Google Recaptcha
Vendors & Products		Webfactoryltd Webfactoryltd advanced Google Recaptcha Wordpress-extensions Wordpress-extensions advanced Google Recaptcha

Tue, 06 Oct 2026 11:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 06 Oct 2026 09:00:00 +0000

Type	Values Removed	Values Added
Description		Unauthenticated Broken Authentication in Advanced Google reCAPTCHA <= 5.40 versions.
Title		WordPress Advanced Google reCAPTCHA plugin <= 5.40 - Broken Authentication vulnerability
Weaknesses		CWE-288
References		https://patchstack.com/database/wordpress/plugin/advanced-google-recaptcha/vulnerability/wordpress-advanced-google-recaptcha-plugin-5-40-broken-authentication-vulnerability?_s_id=cve
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}`

MITRE

Status: PUBLISHED

Assigner: Patchstack

Published: 2026-10-06T08:35:09.522Z

Updated: 2026-10-06T10:31:28.757Z

Reserved: 2026-09-26T00:17:50.216Z

Link: CVE-2026-100518

Vulnrichment

Updated: 2026-10-06T10:28:23.640Z

NVD

Status : Deferred

Published: 2026-10-06T09:17:37.283

Modified: 2026-10-06T15:04:25.990

Link: CVE-2026-100518

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-100518", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-09-26T00:17:50.216Z", "datePublished": "2026-10-06T08:35:09.522Z", "dateUpdated": "2026-10-06T10:31:28.757Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-10-06T08:35:09.522Z"}, "title": "WordPress Advanced Google reCAPTCHA plugin <= 5.40 - Broken Authentication vulnerability", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-288", "description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-50", "descriptions": [{"lang": "en", "value": "CAPEC-50 Password Recovery Exploitation"}]}], "affected": [{"vendor": "WebFactory", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "advanced-google-recaptcha", "product": "Advanced Google reCAPTCHA", "versions": [{"lessThanOrEqual": "5.40", "status": "affected", "version": "n/a", "versionType": "custom", "changes": [{"at": "5.41", "status": "unaffected"}]}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Unauthenticated Broken Authentication in Advanced Google reCAPTCHA <= 5.40 versions."}], "value": "Unauthenticated Broken Authentication in Advanced Google reCAPTCHA <= 5.40 versions."}], "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/wordpress/plugin/advanced-google-recaptcha/vulnerability/wordpress-advanced-google-recaptcha-plugin-5-40-broken-authentication-vulnerability?_s_id=cve"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE", "version": "3.1", "baseSeverity": "MEDIUM", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Update the WordPress Advanced Google reCAPTCHA plugin to the latest available version (at least 5.41)."}], "value": "Update the WordPress Advanced Google reCAPTCHA plugin to the latest available version (at least 5.41)."}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Asim Alshaya | Patchstack Bug Bounty Program"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-100518", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-06T10:10:25.262382Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-06T10:31:28.757Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-100518", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-09-26T00:17:50.216Z", "datePublished": "2026-10-06T08:35:09.522Z", "dateUpdated": "2026-10-06T10:31:28.757Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-10-06T08:35:09.522Z"}, "title": "WordPress Advanced Google reCAPTCHA plugin <= 5.40 - Broken Authentication vulnerability", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-288", "description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-50", "descriptions": [{"lang": "en", "value": "CAPEC-50 Password Recovery Exploitation"}]}], "affected": [{"vendor": "WebFactory", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "advanced-google-recaptcha", "product": "Advanced Google reCAPTCHA", "versions": [{"lessThanOrEqual": "5.40", "status": "affected", "version": "n/a", "versionType": "custom", "changes": [{"at": "5.41", "status": "unaffected"}]}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Unauthenticated Broken Authentication in Advanced Google reCAPTCHA <= 5.40 versions."}], "value": "Unauthenticated Broken Authentication in Advanced Google reCAPTCHA <= 5.40 versions."}], "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/wordpress/plugin/advanced-google-recaptcha/vulnerability/wordpress-advanced-google-recaptcha-plugin-5-40-broken-authentication-vulnerability?_s_id=cve"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE", "version": "3.1", "baseSeverity": "MEDIUM", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Update the WordPress Advanced Google reCAPTCHA plugin to the latest available version (at least 5.41)."}], "value": "Update the WordPress Advanced Google reCAPTCHA plugin to the latest available version (at least 5.41)."}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Asim Alshaya | Patchstack Bug Bounty Program"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-100518", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-06T10:10:25.262382Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-06T10:28:23.640Z"}}]}}