CVE-2026-108686: WP Post Author < 4.2.0 - Unauthenticated reCAPTCHA Secret Key Disclosure
The WP Post Author WordPress plugin before 4.2.0 does not restrict the integration settings it returns to visitors, allowing unauthenticated users to read the reCAPTCHA secret key when one has been saved.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WP Post Authorto a version that resolves this vulnerability.Fixed in 4.2.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
WordPress sites using WP Post Author versions earlier than 4.2.0 are exposed if a reCAPTCHA secret key has been saved in the plugin's integration settings.
Does an attacker need an account or other authentication?
No. The affected integration settings can be read by unauthenticated visitors.
How can I tell whether my site is affected?
Check the installed WP Post Author version and whether a reCAPTCHA secret key is configured. Versions before 4.2.0 with a saved key are affected.
What should I do if a secret key may have been exposed?
Update WP Post Author to version 4.2.0 or later, then replace the configured reCAPTCHA secret key because unauthenticated visitors may have been able to read it.