The Kcaptcha plugin fails to validate a nonce on its settings page, enabling unauthenticated attackers to submit forged requests that alter the plugin’s configuration. The attacker can disable CAPTCHA on login, registration, password reset, and comment forms, effectively removing a layer of defense against brute‑force and spam attacks. The vulnerability does not provide direct code execution but gives attackers indirect influence over site authentication and commenting workflows, potentially increasing the risk of credential stuffing, automated account creation, or comment flooding.

ksolves Kcaptcha WordPress plugin, all versions up to and including 1.0.1. The issue resides in the admin/setting.php handler, which is used by site administrators to manage CAPTCHA options.

The CVSS score of 4.3 reflects a moderate severity; the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires social engineering of a site administrator to submit a crafted HTTP request to the settings endpoint. Because no nonce or capability checks are performed, any attacker who can trick an admin into clicking a link can change the CAPTCHA settings, potentially disabling security controls and paving the way for automated attacks.