# MailPoet – Newsletters, Email Marketing, and Automation <= 5.41.0 - Unauthenticated CAPTCHA Bypass via Answer Replay on Registration Forms

- **ID:** WPSEC-2026-0950
- **Plugin:** MailPoet – Newsletters, Email Marketing, and Automation (`mailpoet`), https://wordpress.org/plugins/mailpoet/
- **Affected versions:** all versions before 5.42.0
- **Fixed in:** 5.42.0 (Update to 5.42.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-294
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/mailpoet
- **Fix released:** 2026-10-13
- **Published:** 2026-10-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0950/

## Description

The MailPoet plugin for WordPress is vulnerable to CAPTCHA Bypass via the built-in CAPTCHA on the WordPress and WooCommerce registration forms in all versions up to, and including, 5.41.0, due to the CAPTCHA session and its phrase not being invalidated after a correct answer is accepted during registration. This makes it possible for unauthenticated attackers to solve one CAPTCHA and reuse the same session ID and answer for any number of registrations until the session expires, which allows automated account registrations when the built-in CAPTCHA is enabled for registration forms.

## References

- https://wpsec.com/vuln/WPSEC-2026-0950/
- https://plugins.svn.wordpress.org/mailpoet/tags/5.42.0/
- https://wordpress.org/plugins/mailpoet/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0950/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.