Executive Summary

The Blue Captcha plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to and including 2.0.1. This vulnerability arises because the plugin's main admin panel and certain subpages accept parameters from user requests without proper nonce validation. Specifically, destructive operations like uninstalling the plugin, deleting logs, removing entries from the Hall of Shame, and adding IP addresses to the banned list can be triggered without verifying the authenticity of the request.

As a result, an attacker can trick a site administrator into performing these actions by making them click on a malicious link, leading to unauthorized changes on the site.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to perform unauthorized destructive actions on your WordPress site if they can trick an administrator into clicking a malicious link. These actions include uninstalling the Blue Captcha plugin, deleting audit logs, removing entries from the Hall of Shame, and adding arbitrary IP addresses to the block list.

Such actions can disrupt your site's security measures, remove evidence of malicious activity, and potentially block legitimate users or allow attackers to manipulate access controls.

Useful 0 Not Useful 0