The Conditional CAPTCHA WordPress plugin version 4.0.0 and earlier fails to validate a URL passed as a parameter before executing a redirect. An attacker can craft a link that steers a visitor’s browser to an arbitrary site, enabling phishing, credential theft, or delivery of malicious content by exploiting the victim’s trust in the legitimate page. This flaw does not expose or modify sensitive data, and it does not alter system state or availability; the primary consequence is the loss of user confidence and potential credential compromise through deceptive redirects.

WordPress sites that have installed the Conditional CAPTCHA plugin and load it in any context exposed to the vulnerable redirect parameter are affected. If a site uses version 4.0.0 or older, regardless of theme or other plugins, the redirect vulnerability is present.

The reported CVSS score suggests moderate risk, while the associated probability of exploitation is low. The vulnerability is not included in the known exploited vulnerabilities catalog. Attackers can exploit the flaw by enticing users to follow a manipulated link; no authentication or privileged access is required. The attack vector is user‑initiated via a crafted URL, yielding a moderate overall threat that can be mitigated by prompt remediation.