{
 "id": "WPSEC-2026-1764",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1764/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1764/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1764/index.md",
 "title": "Password Protected <= 2.8.4 - Unauthenticated reCAPTCHA v3 Bypass",
 "description": "The Password Protected plugin for WordPress is vulnerable to a CAPTCHA bypass via the Google reCAPTCHA v3 check on the password login form in all versions up to, and including, 2.8.4. This is because the verify_recaptcha() function fails open: it records no error when the 'g-recaptcha-response' token is missing or empty, or when Google's verification response reports failure. This makes it possible for unauthenticated attackers to skip the CAPTCHA on the site password form and make automated brute-force attempts against the site password. Exploitation requires that reCAPTCHA v3 is enabled.",
 "plugin": {
  "slug": "password-protected",
  "name": "Password Protected",
  "full_name": "Password Protected – Protect Your Site Content With a Password",
  "wordpress_org": "https://wordpress.org/plugins/password-protected/",
  "advisories_url": "https://wpsec.com/vuln/plugin/password-protected/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/password-protected"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-636"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.6.0",
    "from_inclusive": true,
    "to": "2.8.5",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.6.0 before 2.8.5"
  ]
 },
 "introduced_in": "2.6.0",
 "fixed_in": "2.8.5",
 "remediation": "Update to 2.8.5 or later.",
 "fix_released": "2026-10-26T14:31:34+00:00",
 "published": "2026-10-27T14:45:37+00:00",
 "updated": "2026-10-27T13:05:14.676558+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1764/",
  "https://plugins.svn.wordpress.org/password-protected/tags/2.8.5/",
  "https://wordpress.org/plugins/password-protected/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/password-protected",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-27"
 }
}