The MTCaptcha WordPress Plugin contains a Cross‑Site Request Forgery weakness that allows an attacker to modify the plugin’s configuration, including sensitive values such as the private key. This flaw stems from omitted or incorrect nonce validation on the settings‑update routine and is categorized as CWE‑352. If exploited, an attacker could alter authentication credentials or other critical settings without needing administrator credentials. The impact is a potential compromise of the site’s security configuration and loss of trust in the protected functionalities that rely on the plugin.

Versions of the MTCaptcha WordPress Plugin up to and including 2.7.2 are affected. The vulnerability is reported for all deployments of this plugin that have not yet applied the latest fix. Only sites running a newer plugin version are immune.

The CVSS score of 4.3 indicates moderate severity, but the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to require a social‑engineering component, such as convincing a site administrator to click a crafted link that submits a forged request to the settings endpoint. No additional conditions beyond the normal administrator session are required for exploitation.