CVE-2026-121612: WordPress WPBruiser {no- Captcha anti-Spam} plugin <= 3.6.2 - Broken Authentication vulnerability
Published Nov 9, 2026
·Updated
Weak Authentication vulnerability in WPZOOM WPBruiser {no- Captcha anti-Spam} goodbye-captcha allows Authentication Abuse.This issue affects WPBruiser {no- Captcha anti-Spam}: from n/a through 3.6.2.
Affected Software
1 affected component
WPZOOM WPBruiser (no-Captcha anti-Spam)<=3.6.2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress WPBruiser {no- Captcha anti-Spam}to a version that resolves this vulnerability.Fixed in 3.6.3
Event History
Nov 9, 2026
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·05:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The vulnerability requires low-level privileges (PR:L). It is remotely reachable over the network and does not require user interaction.
2
What is the expected impact if exploitation succeeds?
The reported impact is limited to integrity, meaning an attacker may be able to alter data or application state. No confidentiality or availability impact is indicated by the supplied severity vector.