Junglewise Threat Intelligence

CVE-2026-10552: jotis Blue Captcha CSRF in administrative panels

CVE-2026-10552 · Severity: medium · CVSS 4.3 · Published 2026-06-24

Executive brief

The Blue Captcha plugin for WordPress, which provides security challenges to prevent automated spam, contains a vulnerability that could allow an attacker to trick an administrator into performing unintended actions. By convincing a logged-in admin to click a malicious link, an attacker could force the plugin to uninstall itself, delete security logs, or block arbitrary IP addresses. This could lead to a loss of security monitoring data or a disruption of service for legitimate users.

Technical details

The Blue Captcha plugin for WordPress (versions <= 2.0.1) is vulnerable to Cross-Site Request Forgery (CSRF) because it fails to implement nonce validation on several administrative subpages, including the main admin panel, Hall of Shame, and Log pages. Specifically, the plugin lacks calls to wp_verify_nonce(), check_admin_referer(), or check_ajax_referer() when processing the 'blcap_action' and 'action' parameters from $_REQUEST. An unauthenticated attacker can exploit this by inducing a site administrator to interact with a specially crafted link or request. Successful exploitation allows the attacker to execute destructive operations such as calling blcap_uninstall(), deleting logs via blcap_delete_logs(), clearing the IP database via blcap_delete_ip_db(), or modifying the banned IP list.

Affected products

  • jotis Blue Captcha up to and including 2.0.1

Timeline

  • 2026-06-24: disclosed
  • 2026-06-24: advisory

References