The WPBruiser {no- Captcha anti-Spam} plugin contains a Weak Authentication vulnerability that allows attackers to abuse authentication controls and gain unauthorized access. The flaw stems from improper handling of user credentials, permitting authentication bypass. Consequently, an attacker could impersonate legitimate users or create new accounts to compromise site integrity.

This issue affects all installations of the WPBruiser {no- Captcha anti-Spam} plugin version 3.6.2 and earlier on WordPress sites. The affected vendor is WPZOOM. The vulnerability is present from the initial release up to version 3.6.2.

The vulnerability has a CVSS score of 4.3, indicating moderate severity. EPSS is not available, which suggests insufficient data to assess exploitation probability, though the flaw is not listed in CISA KEV. It is most likely exploitable by remote attackers who can send crafted requests to the plugin’s authentication endpoints on a WordPress site that hosts the vulnerable plugin. The attacker would need to be able to interact with the site, but no additional privileged access is required. The presence of this weakness facilitates unauthorized access to authenticated sessions.