WPBruiser {no- Captcha anti-Spam} <= 3.6.2 - Authenticated (Subscriber+) Login Lockout Bypass via Failed Login Counter Reset
- ID
- WPSEC-2026-2508
- Plugin
- WPBruiser Security – No CAPTCHA Anti-Spam & Login Protection (goodbye-captcha)
- Affected
- from 3.4.0 before 3.6.3
- Remediation
- Update to 3.6.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-307
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-04
- Attack surface
- WPBruiser {no- Captcha anti-Spam} on WPSec AttackSurface
- Fix released
- Published
Description
The WPBruiser Security – No CAPTCHA Anti-Spam & Login Protection plugin for WordPress is vulnerable to a login lockout (brute force protection) bypass via the failed login counter in all versions up to, and including, 3.6.2. This is due to the plugin counting failed logins only per IP address and deleting that whole counter whenever any account logs in successfully from the same IP address. This makes it possible for authenticated attackers, with subscriber-level access and above, to log in to their own account between password guesses against another account, which resets the counter so the lockout never triggers. Attackers can then keep guessing other users' passwords, including administrators' passwords.
References
- https://wpsec.com/vuln/WPSEC-2026-2508/
- https://plugins.svn.wordpress.org/goodbye-captcha/tags/3.6.3/
- https://wordpress.org/plugins/goodbye-captcha/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS