CVE-2026-94457: WordPress Captcha Code plugin <= 3.32 - Bypass Vulnerability vulnerability

Q: Who can exploit this issue?

The vulnerability is unauthenticated, so an attacker does not need a WordPress account or prior privileges. Exploitation is network-accessible, although the high attack-complexity rating indicates additional conditions or steps are required.

Q: What security impact is indicated?

Successful exploitation may result in limited confidentiality and integrity impact. No availability impact is indicated by the supplied CVSS vector.

Q: Which plugin versions are affected?

Captcha Code plugin versions up to and including 3.32 are identified as affected. The provided data does not specify a fixed version or workaround.

Published Sep 23, 2026

Updated

Unauthenticated Bypass Vulnerability in Captcha Code <= 3.32 versions.

Affected Software

1 affected component

Bestwebsoft Captcha Code<=3.32

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Captcha Code plugin to a version that resolves this vulnerability.
Fixed in 3.33

Event History

Sep 23, 2026

CVE Published

via MITRE·06:14 PM

Data Sourced

via MITRE·06:14 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·07:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

The vulnerability is unauthenticated, so an attacker does not need a WordPress account or prior privileges. Exploitation is network-accessible, although the high attack-complexity rating indicates additional conditions or steps are required.

What security impact is indicated?