The Blue Captcha plugin for WordPress suffers from missing or incorrect nonce validation on several admin pages, including the main panel and its subpages. Because the actions "blcap_action" and "action" are taken directly from $_REQUEST without any wp_verify_nonce(), check_admin_referer(), or check_ajax_referer() checks, an attacker can craft a forged request that an administrator will unknowingly trigger. This allows destructive operations such as uninstalling the plugin, deleting audit logs, wiping Hall of Shame entries, and adding arbitrary IP addresses to the block list.

WordPress sites running the Blue Captcha plugin version 2.0.1 or earlier, as distributed by the vendor jotis. Any installation of these versions is vulnerable regardless of the WordPress core version or other plugins.

The CVSS score of 4.3 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. The exploit requires an attacker to trick a site administrator into opening a specially crafted link or form; thus, it relies on social engineering rather than privilege escalation. Sites with an active WordPress admin who has access to the Blue Captcha pages are at risk of having the plugin uninstalled, logs erased, or IP addresses added to the block list.