{"id":"CVE-2026-108686","kind":"vulnerability","aliases":["CVE-2026-108686"],"related":[],"title":"WP Post Author WordPress plugin leaks reCAPTCHA secret key to visitors","description":"The WP Post Author  WordPress plugin before 4.2.0 does not restrict the integration settings it returns to visitors, allowing unauthenticated users to read the reCAPTCHA secret key when one has been saved.","summary":"The WP Post Author plugin before 4.2.0 returns its integration settings to any visitor without checking permissions. An unauthenticated attacker can read the saved reCAPTCHA secret key.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","wordpress","wp-post-author"],"not_affected_if":["no-recaptcha-secret-saved","not-installed","version-4.2.0-or-later"],"how_to_check":"- Check the installed version of the WP Post Author plugin in the WordPress admin under Plugins, and see whether it is earlier than `4.2.0`.\n- Check whether a reCAPTCHA secret key has been saved in the plugin's integration settings.","fix":"- WP Post Author plugin: move to `4.2.0` or later.","status":"open","published_at":"2026-10-29T06:17:17+00:00","first_seen_at":"2026-10-29T06:53:13+00:00","triaged_at":"2026-10-29T06:54:56+00:00","updated_at":"2026-10-29T06:54:56+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-29T06:54:56Z","model":"claude-haiku-5-5","output":{"fix":"- WP Post Author plugin: move to `4.2.0` or later.","reach":"internet","title":"WP Post Author WordPress plugin leaks reCAPTCHA secret key to visitors","impact":"low","summary":"The WP Post Author plugin before 4.2.0 returns its integration settings to any visitor without checking permissions. An unauthenticated attacker can read the saved reCAPTCHA secret key.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-post-author"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated visitors read the reCAPTCHA secret key","analyst_note":"","how_to_check":"- Check the installed version of the WP Post Author plugin in the WordPress admin under Plugins, and see whether it is earlier than `4.2.0`.\n- Check whether a reCAPTCHA secret key has been saved in the plugin's integration settings.","plain_action":"","needs_analyst":false,"not_affected_if":["not-installed","version-4.2.0-or-later","no-recaptcha-secret-saved"],"who_is_affected":"Sites running the WP Post Author WordPress plugin before 4.2.0 that have a reCAPTCHA secret key saved in its integration settings are exposed. Sites without the plugin, on a later version, or without a saved reCAPTCHA secret key are not affected by the key exposure.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000679,"input_tokens":4093,"output_tokens":540,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-108686':14A,17A '-2026':13A,16A '4.2.0':30B,58C 'allow':69C 'attack':43B 'author':3A,23B,27B,54C 'check':39B 'cve':12A,15A 'integr':33B,63C 'key':9A,50B,77C 'leak':6A 'one':79C 'packag':18B 'permiss':40B 'plugin':5A,28B,56C 'post':2A,22B,26B,53C 'read':45B,73C 'recaptcha':7A,48B,75C 'restrict':61C 'return':31B,66C 'save':47B,82C 'secret':8A,49B,76C 'set':34B,64C 'unauthent':42B,70C 'user':71C 'visitor':11A,37B,68C 'without':38B 'wordpress':4A,19B,55C 'wp':1A,21B,25B,52C 'wp-post-author':20B","nicknames":[],"mitigations":[],"who_affected":"Sites running the WP Post Author WordPress plugin before 4.2.0 that have a reCAPTCHA secret key saved in its integration settings are exposed. Sites without the plugin, on a later version, or without a saved reCAPTCHA secret key are not affected by the key exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T06:17:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108686","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108686","severity":null,"published_at":"2026-10-29T06:17:17+00:00","modified_at":"2026-10-29T06:17:17+00:00","first_seen_at":"2026-10-29T06:53:13+00:00","fetched_at":"2026-10-29T06:53:13+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}