The ZT Captcha plugin for WordPress suffers from an improper nonce validation in its settings saving action. An attacker can supply an empty nonce token that bypasses the check, enabling the modification of plugin configuration without authentication. Changes to these settings could alter site behavior or security posture, potentially exposing the site to further attacks if the administrator trusts malicious configurations.

This vulnerability affects WordPress sites utilizing the ZT Captcha plugin version 1.0.4 or earlier. The affected vendor is teamzt and the product is ZT Captcha. No specific version list beyond 1.0.4 is required because the issue exists in all prior releases.

The overall severity is moderately low, reflected in a CVSS score of 4.3. The EPSS score is below 1 %, indicating a very low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector requires an unauthenticated attacker to trick a logged‑in administrator into sending a forged request—most commonly by clicking a malicious link or loading a crafted image. Once the admin performs the action, the attacker can alter the plugin settings silently. Because this is a CSRF flaw, it does not require additional privileges beyond the victim’s account, but the impact is limited to adjusting settings for that single WordPress installation.