{
 "id": "WPSEC-2026-1082",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1082/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1082/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1082/index.md",
 "title": "Nexter Extension <= 4.7.12 - Unauthenticated CAPTCHA Bypass via Missing Cloudflare Turnstile Token",
 "description": "The Nexter Extension plugin for WordPress is vulnerable to a CAPTCHA bypass in all versions up to, and including, 4.7.12. This is due to the Cloudflare Turnstile checks on the login, registration, password reset and comment forms skipping verification when the request has no cf-turnstile-response value, so they rejected only submissions with an invalid token. This makes it possible for unauthenticated attackers to get past the Turnstile protection on these forms when the site owner has turned it on, which allows automated login attempts, spam registrations and comment spam.",
 "plugin": {
  "slug": "nexter-extension",
  "name": "Nexter Extension",
  "full_name": "Nexter Extension – Security, Performance, Code Snippets & Site Toolkit",
  "wordpress_org": "https://wordpress.org/plugins/nexter-extension/",
  "advisories_url": "https://wpsec.com/vuln/plugin/nexter-extension/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/nexter-extension"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-693"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.7.13",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.7.13"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.7.13",
 "remediation": "Update to 4.7.13 or later.",
 "fix_released": "2026-10-15T10:46:30+00:00",
 "published": "2026-10-16T11:46:25+00:00",
 "updated": "2026-10-16T10:56:21.544826+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1082/",
  "https://plugins.svn.wordpress.org/nexter-extension/tags/4.7.13/",
  "https://wordpress.org/plugins/nexter-extension/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/nexter-extension",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-16"
 }
}