CVE-2026-112348

Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vulnerability that allows unauthenticated attackers to submit frontend forms without valid verification by omitting the g-recaptcha-token field from POST requests to the form submission endpoint. Attackers can exploit the verify...

CVE-2026-112348 Kirki WordPress Plugin < 6.2.5 reCAPTCHA Bypass via Missing Token

Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vulnerability that allows unauthenticated attackers to submit frontend forms without valid verification by omitting the g-recaptcha-token field from POST requests to the form submission endpoint. Attackers can exploit the verify...

CVE-2026-112348

The Kirki plugin for WordPress (versions before 6.2.5 ) is vulnerable to a reCAPTCHA bypass due to a flaw in the verify() method. Unauthenticated attackers can submit frontend forms without valid verification by omitting the g-recaptcha-token field from POST requests. The method incorrectly perfo...

EUVD-2026-114057

Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vulnerability that allows unauthenticated attackers to submit frontend forms without valid verification by omitting the g-recaptcha-token field from POST requests to the form submission endpoint. Attackers can exploit the verify...

PT-2026-133571

Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vulnerability that allows unauthenticated attackers to submit frontend forms without valid verification by omitting the g-recaptcha-token field from POST requests to the form submission endpoint. Attackers can exploit the verify...

CVE-2026-112348: Themeum Kirki: Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vulnerability that allows unauthenticated attackers…

Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vulnerability that allows unauthenticated attackers to submit frontend forms without valid verification by omitting the g-recaptcha-token field from POST requests to the form submission endpoint. Attackers can exploit the verify...

WordPress Profile Builder plugin 4.0.0-4.0.4 - Subscriber+ Comment reCAPTCHA Bypass vulnerability

Subscriber+ Comment reCAPTCHA Bypass vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Profile Builder versions 4.0.0-4.0.4...

CVE-2026-111965

The Profile Builder WordPress plugin from 4.0.0 to 4.0.4 does not enforce its reCAPTCHA verification on all comment submission paths, allowing authenticated users to bypass the anti-spam protection an administrator configured for the WordPress comment form...

CVE-2026-111965 Profile Builder 4.0.0 - 4.0.4 - Subscriber+ Comment reCAPTCHA Bypass

The Profile Builder WordPress plugin from 4.0.0 to 4.0.4 does not enforce its reCAPTCHA verification on all comment submission paths, allowing authenticated users to bypass the anti-spam protection an administrator configured for the WordPress comment form...

CVE-2026-111965

The Profile Builder WordPress plugin, versions 4.0.0 through 4.0.4 , contains a vulnerability where reCAPTCHA verification is not enforced on all comment submission paths. This flaw allows authenticated users to bypass the anti-spam protections configured by an administrator for the WordPress com...

CVE-2026-111965 Profile Builder 4.0.0 - 4.0.4 - Subscriber+ Comment reCAPTCHA Bypass

The Profile Builder WordPress plugin from 4.0.0 to 4.0.4 does not enforce its reCAPTCHA verification on all comment submission paths, allowing authenticated users to bypass the anti-spam protection an administrator configured for the WordPress comment form...

EUVD-2026-108667

The Profile Builder WordPress plugin from 4.0.0 to 4.0.4 does not enforce its reCAPTCHA verification on all comment submission paths, allowing authenticated users to bypass the anti-spam protection an administrator configured for the WordPress comment form...

PT-2026-121829

The Profile Builder WordPress plugin from 4.0.0 to 4.0.4 does not enforce its reCAPTCHA verification on all comment submission paths, allowing authenticated users to bypass the anti-spam protection an administrator configured for the WordPress comment form...

CVE-2024-5563: Missing Authentication for Critical Function

Due to an incomplete implementation, reCaptcha is not applied to certain authentication flows even when the reCaptcha option is enabled. This oversight permits attackers to bypass the intended protection mechanism. Brute force attacks, if successful, can lead to unauthorized access to user accoun...

WordPress Paid Membership Subscriptions plugin < 3.1.0 - Unauthenticated reCAPTCHA Bypass vulnerability

Unauthenticated reCAPTCHA Bypass vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Paid Member Subscriptions versions 3.1.0...

CVE-2026-90950

The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not verify the reCAPTCHA on its registration handler when a form field is absent from the request, allowing unauthenticated users to create accounts without solving the reCAPTCHA the site has enabled...

EUVD-2026-85195

The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not verify the reCAPTCHA on its registration handler when a form field is absent from the request, allowing unauthenticated users to create accounts without solving the reCAPTCHA the site has enabled...

CVE-2026-90950

The Paid Membership Subscriptions WordPress plugin, in versions prior to 3.1.0 , is vulnerable to a security flaw in its registration handler . The root cause is a failure to verify the reCAPTCHA when a form field is missing from the request. This allows unauthenticated users to bypass the reCAPT...

CVE-2026-90950 Paid Member Subscriptions < 3.1.0 - Unauthenticated reCAPTCHA Bypass via Registration Form

The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not verify the reCAPTCHA on its registration handler when a form field is absent from the request, allowing unauthenticated users to create accounts without solving the reCAPTCHA the site has enabled...

CVE-2026-90950 Paid Member Subscriptions < 3.1.0 - Unauthenticated reCAPTCHA Bypass via Registration Form

The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not verify the reCAPTCHA on its registration handler when a form field is absent from the request, allowing unauthenticated users to create accounts without solving the reCAPTCHA the site has enabled...