---
id: "CVE-2026-108686"
kind: "vulnerability"
aliases: ["CVE-2026-108686"]
title: "WP Post Author WordPress plugin leaks reCAPTCHA secret key to visitors"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "wordpress", "wp-post-author"]
not_affected_if: ["no-recaptcha-secret-saved", "not-installed", "version-4.2.0-or-later"]
published_at: "2026-10-29T06:17:17+00:00"
first_seen_at: "2026-10-29T06:53:13+00:00"
updated_at: "2026-10-29T06:54:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108686", "first_seen_at": "2026-10-29T06:53:13+00:00"}]
---

# WP Post Author WordPress plugin leaks reCAPTCHA secret key to visitors

The WP Post Author plugin before 4.2.0 returns its integration settings to any visitor without checking permissions. An unauthenticated attacker can read the saved reCAPTCHA secret key.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the WP Post Author plugin in the WordPress admin under Plugins, and see whether it is earlier than `4.2.0`.
- Check whether a reCAPTCHA secret key has been saved in the plugin's integration settings.

## Fix

- WP Post Author plugin: move to `4.2.0` or later.

## Timeline

- 2026-10-29T06:53:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-108686

## From the sources

The WP Post Author  WordPress plugin before 4.2.0 does not restrict the integration settings it returns to visitors, allowing unauthenticated users to read the reCAPTCHA secret key when one has been saved.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_