Vulnerabilities / Password Protected / WPSEC-2026-1764
Password Protected <= 2.8.4 - Unauthenticated reCAPTCHA v3 Bypass
Low 3.7
CWE-636Fixed in 2.8.5
- ID
- WPSEC-2026-1764
- Plugin
- Password Protected – Protect Your Site Content With a Password (password-protected)
- Affected
- from 2.6.0 before 2.8.5
- Remediation
- Update to 2.8.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-636
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-27
- Attack surface
- Password Protected on WPSec AttackSurface
- Fix released
- Published
Description
The Password Protected plugin for WordPress is vulnerable to a CAPTCHA bypass via the Google reCAPTCHA v3 check on the password login form in all versions up to, and including, 2.8.4. This is because the verify_recaptcha() function fails open: it records no error when the 'g-recaptcha-response' token is missing or empty, or when Google's verification response reports failure. This makes it possible for unauthenticated attackers to skip the CAPTCHA on the site password form and make automated brute-force attempts against the site password. Exploitation requires that reCAPTCHA v3 is enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-1764/
- https://plugins.svn.wordpress.org/password-protected/tags/2.8.5/
- https://wordpress.org/plugins/password-protected/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS