Vulnerabilities / MailPoet – Newsletters, Email Marketing, and Automation / WPSEC-2026-0950
MailPoet – Newsletters, Email Marketing, and Automation <= 5.41.0 - Unauthenticated CAPTCHA Bypass via Answer Replay on Registration Forms
Medium 5.3
CWE-294Fixed in 5.42.0
- ID
- WPSEC-2026-0950
- Plugin
- MailPoet – Newsletters, Email Marketing, and Automation (mailpoet)
- Affected
- all versions before 5.42.0
- Remediation
- Update to 5.42.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-294
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-14
- Attack surface
- MailPoet – Newsletters, Email Marketing, and Automation on WPSec AttackSurface
- Fix released
- Published
Description
The MailPoet plugin for WordPress is vulnerable to CAPTCHA Bypass via the built-in CAPTCHA on the WordPress and WooCommerce registration forms in all versions up to, and including, 5.41.0, due to the CAPTCHA session and its phrase not being invalidated after a correct answer is accepted during registration. This makes it possible for unauthenticated attackers to solve one CAPTCHA and reuse the same session ID and answer for any number of registrations until the session expires, which allows automated account registrations when the built-in CAPTCHA is enabled for registration forms.
References
- https://wpsec.com/vuln/WPSEC-2026-0950/
- https://plugins.svn.wordpress.org/mailpoet/tags/5.42.0/
- https://wordpress.org/plugins/mailpoet/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS