The vulnerability is an unauthenticated bypass in the Captcha by BestWebSoft plugin for WordPress version 5.2.8 and earlier, representing a CWE‑290 weakness, where the plugin fails to verify the requester's authentication status before providing a valid captcha response. This allows any user, regardless of login state, to circumvent the captcha that protects login or form submissions from automated abuse.

The Captcha by BestWebSoft plugin for WordPress, authored by BestWebSoft, in any release through 5.2.8 is affected.

The CVSS score of 5.3 indicates a moderate severity vulnerability. Exploitation requires no credentials and can be performed via standard HTTP requests to the plugin’s captcha endpoint. The EPSS score of 0.00357 indicates a very low but nonzero probability of exploitation, and the CVE is not listed in the CISA KEV catalog. With the guessed attack vector being a simple web request, the susceptibility is moderate but widespread across any site still running an affected plugin version.