CVE-2026-108686
Received Received - Intake

Unauthenticated Access to reCAPTCHA Secret Key in WP Post Author

Publication date: 2026-10-29

Last updated on: 2026-10-29

Assigner: WPScan

Description
The WP Post Author WordPress plugin before 4.2.0 does not restrict the integration settings it returns to visitors, allowing unauthenticated users to read the reCAPTCHA secret key when one has been saved.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-29
Last Modified
2026-10-29
Generated
2026-10-29
AI Q&A
2026-10-29
EPSS Evaluated
N/A
NVD
CVE-2026-108686
EUVD
EUVD-2026-112619

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown WP Post Author 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The WP Post Author WordPress plugin before version 4.2.0 has a flaw where it does not properly restrict access to its integration settings. This allows unauthenticated users to view the reCAPTCHA secret key if it was saved in the plugin.

Detection Guidance

Check if the WP Post Author plugin version is below 4.2.0 by inspecting the plugin files or WordPress admin panel. Look for exposed reCAPTCHA secret keys in integration settings accessible without authentication.

Impact Analysis

This vulnerability exposes the reCAPTCHA secret key, which could allow attackers to bypass reCAPTCHA protections on forms, spam submissions, or perform automated attacks. It may also lead to further exploitation if the secret key is used elsewhere.

Mitigation Strategies

Update the WP Post Author plugin to version 4.2.0 or later immediately. Review and restrict access to integration settings to prevent unauthorized access to sensitive data.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108686. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart