CVE-2026-1075
CSRF Vulnerability in ZT Captcha Plugin Allows Settings Modification
Publication date: 2026-01-24
Last updated on: 2026-01-24
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| unknown_vendor | zt_captcha | to 1.0.4 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Cross-Site Request Forgery (CSRF) issue in the ZT Captcha WordPress plugin (versions up to and including 1.0.4). It occurs because the plugin improperly validates the nonce token on the save_ztcpt_captcha_settings action, allowing an attacker to bypass the nonce check by sending an empty token value. As a result, an unauthenticated attacker can trick a site administrator into performing an action, such as clicking a malicious link, which then allows the attacker to modify the plugin's settings without authorization.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing an attacker to change the CAPTCHA plugin's settings without your consent. Since CAPTCHA settings affect how user interactions are validated on your WordPress site (such as login, registration, password reset, and comments), unauthorized changes could weaken your site's defenses against automated attacks or spam. This could lead to increased spam, reduced security on user authentication forms, or other unintended behaviors that compromise your site's integrity.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for unauthorized POST requests to the WordPress admin action endpoint that attempts to save CAPTCHA settings without a valid nonce token or with an empty nonce token. Specifically, look for POST requests to the 'admin-post.php' endpoint with the action parameter 'save_ztcpt_captcha_settings'. Network monitoring tools or web server logs can be searched for such requests. For example, you can use the following command to search web server logs for suspicious requests: grep 'action=save_ztcpt_captcha_settings' /path/to/access.log. Additionally, inspecting HTTP requests for missing or empty nonce tokens in the POST data can help identify exploitation attempts. [1, 3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating the ZT Captcha plugin to a version later than 1.0.4 where the nonce validation issue is fixed. If an update is not immediately available, restrict access to the WordPress admin area to trusted IP addresses and ensure administrators are cautious about clicking on untrusted links. Additionally, consider implementing Web Application Firewall (WAF) rules to block unauthorized POST requests to 'admin-post.php' with the action 'save_ztcpt_captcha_settings' that contain empty or missing nonce tokens. [1, 3]