{
 "id": "WPSEC-2026-2508",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2508/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2508/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2508/index.md",
 "title": "WPBruiser {no- Captcha anti-Spam} <= 3.6.2 - Authenticated (Subscriber+) Login Lockout Bypass via Failed Login Counter Reset",
 "description": "The WPBruiser Security – No CAPTCHA Anti-Spam & Login Protection plugin for WordPress is vulnerable to a login lockout (brute force protection) bypass via the failed login counter in all versions up to, and including, 3.6.2. This is due to the plugin counting failed logins only per IP address and deleting that whole counter whenever any account logs in successfully from the same IP address. This makes it possible for authenticated attackers, with subscriber-level access and above, to log in to their own account between password guesses against another account, which resets the counter so the lockout never triggers. Attackers can then keep guessing other users' passwords, including administrators' passwords.",
 "plugin": {
  "slug": "goodbye-captcha",
  "name": "WPBruiser {no- Captcha anti-Spam}",
  "full_name": "WPBruiser Security – No CAPTCHA Anti-Spam & Login Protection",
  "wordpress_org": "https://wordpress.org/plugins/goodbye-captcha/",
  "advisories_url": "https://wpsec.com/vuln/plugin/goodbye-captcha/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/goodbye-captcha"
 },
 "type": "AUTHBYPASS",
 "cwe": [
  "CWE-307"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "3.4.0",
    "from_inclusive": true,
    "to": "3.6.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 3.4.0 before 3.6.3"
  ]
 },
 "introduced_in": "3.4.0",
 "fixed_in": "3.6.3",
 "remediation": "Update to 3.6.3 or later.",
 "fix_released": "2026-11-03T16:04:39+00:00",
 "published": "2026-11-04T17:01:02+00:00",
 "updated": "2026-11-04T13:58:30.889543+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2508/",
  "https://plugins.svn.wordpress.org/goodbye-captcha/tags/3.6.3/",
  "https://wordpress.org/plugins/goodbye-captcha/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/goodbye-captcha",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-04"
 }
}