# WPBruiser {no- Captcha anti-Spam} <= 3.6.2 - Authenticated (Subscriber+) Login Lockout Bypass via Failed Login Counter Reset

- **ID:** WPSEC-2026-2508
- **Plugin:** WPBruiser Security – No CAPTCHA Anti-Spam & Login Protection (`goodbye-captcha`), https://wordpress.org/plugins/goodbye-captcha/
- **Affected versions:** from 3.4.0 before 3.6.3
- **Fixed in:** 3.6.3 (Update to 3.6.3 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-307
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-04)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/goodbye-captcha
- **Fix released:** 2026-11-03
- **Published:** 2026-11-04
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2508/

## Description

The WPBruiser Security – No CAPTCHA Anti-Spam & Login Protection plugin for WordPress is vulnerable to a login lockout (brute force protection) bypass via the failed login counter in all versions up to, and including, 3.6.2. This is due to the plugin counting failed logins only per IP address and deleting that whole counter whenever any account logs in successfully from the same IP address. This makes it possible for authenticated attackers, with subscriber-level access and above, to log in to their own account between password guesses against another account, which resets the counter so the lockout never triggers. Attackers can then keep guessing other users' passwords, including administrators' passwords.

## References

- https://wpsec.com/vuln/WPSEC-2026-2508/
- https://plugins.svn.wordpress.org/goodbye-captcha/tags/3.6.3/
- https://wordpress.org/plugins/goodbye-captcha/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2508/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.