CVE-2026-108686
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The WP Post Author WordPress plugin before 4.2.0 does not restrict the integration settings it returns to visitors, allowing unauthenticated users to read the reCAPTCHA secret key when one has been saved.
Risk Assessment
Exposure of the reCAPTCHA secret key may allow attackers to bypass bot protection mechanisms and abuse the service. This can lead to spam, fake registrations, or other abuse.
Recommendation
Update the WP Post Author plugin to version 4.2.0 or later. Consider regenerating the reCAPTCHA key after updating.
Other vulnerabilities in WP Post Author WordPress plugin
Original NVD description (English source)
The WP Post Author WordPress plugin before 4.2.0 does not restrict the integration settings it returns to visitors, allowing unauthenticated users to read the reCAPTCHA secret key when one has been saved.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS