Live › vulnerability › CVE-2026-108686
The WP Post Author plugin before 4.2.0 returns its integration settings to any visitor without checking permissions. An unauthenticated attacker can read the saved reCAPTCHA secret key.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 06:53 UTC. All times on this page are UTC.
Sites running the WP Post Author WordPress plugin before 4.2.0 that have a reCAPTCHA secret key saved in its integration settings are exposed. Sites without the plugin, on a later version, or without a saved reCAPTCHA secret key are not affected by the key exposure.
No product ranges from the sources yet.
4.2.0.4.2.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The WP Post Author WordPress plugin before 4.2.0 does not restrict the integration settings it returns to visitors, allowing unauthenticated users to read the reCAPTCHA secret key when one has been saved.
This page as .md · .json · in your agent: get_signal("CVE-2026-108686")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.