CVE-2026-4121

OVERVIEW CVE-2026-4121 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Kcaptcha plugin for WordPress in all versions up to and including 1.0.1. The plugin fails to implement proper nonce validation in its settings page handler, allowing unauthenticated attackers to forge requests that modify CAPTCHA configuration settings, including the ability to enable or disable CAPTCHA protection on login, registration, lost password, and comment forms. SEVERITY This vulnerability presents a network-based attack vector requiring no authentication but necessitating user interaction (social engineering). The attack complexity is low, with attackers needing only to trick a site administrator into clicking a malicious link. The impact is limited to integrity violations, as attackers can alter plugin settings but cannot access sensitive data or disrupt availability. The CVSS 3.1 base score of 4.3 (MEDIUM) reflects this limited but meaningful risk. EXPLOITATION STATUS The vulnerability is not currently listed on the Known Exploited Vulnerabilities catalog and shows no indication of active exploitation in the wild, with an extremely low EPSS score of 0.000060000. Community attention appears minimal, as evidenced by the inactive Hot List status. However, the straightforward nature of CSRF attacks and the availability of the vulnerability details suggest that exploitation proof-of-concept code could be readily developed if threat actors choose to target this plugin.