CVE-2026-10552

Name of the Vulnerable Software and Affected Versions Blue Captcha versions prior to 2.0.2

Description The Blue Captcha plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF), a flaw where an attacker tricks a victim into performing actions they did not intend to. This occurs due to missing or incorrect nonce validation—a security token used to ensure requests are legitimate—on the main admin panel ('blcap main page') and the Hall of Shame and Log subpages. These pages accept the blcap action or action parameters from $ REQUEST and execute destructive operations through functions such as blcap uninstall(), blcap delete logs(), blcap delete ip db(), and update option('blcap settings') without verifying the request origin. Consequently, unauthenticated attackers can force a site administrator to uninstall the plugin, delete audit logs, remove Hall of Shame entries, or add arbitrary IP addresses to the block list by tricking them into clicking a malicious link.

Recommendations Update the plugin to a version later than 2.0.1.