CVE-2026-27411
Guessable CAPTCHA Allows Bypass in SiteGuard WP Plugin
Publication date: 2026-03-05
Last updated on: 2026-04-29
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| patchstack | siteguard_wp_plugin | to 1.7.9 (inc) |
| jp-secure | siteguard_wp_plugin | to 1.7.9 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-804 | The product uses a CAPTCHA challenge, but the challenge can be guessed or automatically recognized by a non-human actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "CVE-2026-27411 is a bypass vulnerability in the WordPress SiteGuard WP Plugin versions up to and including 1.7.9. It allows an unauthenticated attacker to bypass certain restrictions in the plugin's code, specifically related to CAPTCHA functionality."}, {'type': 'paragraph', 'content': 'This vulnerability falls under the OWASP Top 10 category A7: Identification and Authentication Failures, meaning it affects the authentication mechanisms of the plugin.'}, {'type': 'paragraph', 'content': 'The vulnerability is of low severity with a CVSS score of 5.4 and requires no privileges to exploit.'}] [1]
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': "This vulnerability allows an attacker to bypass CAPTCHA protections without authentication, potentially enabling automated attacks or abuse of the affected website's functionality."}, {'type': 'paragraph', 'content': 'However, the impact is considered low severity, and it is unlikely to be exploited in a way that causes significant harm.'}] [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
There is no official patch currently available for this vulnerability.
Patchstack provides mitigation and security intelligence services to help protect affected sites.
Since the vulnerability allows an unauthenticated attacker to bypass certain restrictions, it is recommended to monitor and restrict access to the SiteGuard WP Plugin and consider additional security measures such as web application firewalls or other protective controls.