The WP Post Author plugin before version 4.2.0 returns integration settings, including the reCAPTCHA secret key, to any visitor. This allows an unauthenticated user to read a secret that can be used to bypass or impersonate reCAPTCHA checks. The attack is straightforward: by sending a simple HTTP request to the plugin endpoint, the attacker obtains the key with zero authentication or authorization, exposing a critical credential and undermining the website's anti‑spam protection.

Site owners running the WordPress plugin WP Post Author with any version older than 4.2.0 are affected. The vulnerability applies to all installations where the plugin stores a reCAPTCHA secret key, regardless of the WordPress core version or other plugins used.

Although no explicit CVSS score is provided, the vulnerability allows unauthenticated disclosure of a secret key, a high‑impact condition. The absence of requirement for attacker privileges means exploitation effort is low. No known public exploits or KEV listing indicate that this has not yet been actively leveraged, but the potential to compromise reCAPTCHA protection makes it a significant security risk for sites relying on the plugin for spam prevention.