{"id":"CVE-2026-111965","kind":"vulnerability","aliases":["CVE-2026-111965"],"related":[],"title":"Profile Builder WordPress plugin: reCAPTCHA skipped on some comment paths","description":"The Profile Builder WordPress plugin from 4.0.0 to 4.0.4 does not enforce its reCAPTCHA verification on all comment submission paths, allowing authenticated users to bypass the anti-spam protection an administrator configured for the WordPress comment form.","summary":"The Profile Builder WordPress plugin versions 4.0.0 through 4.0.4 do not enforce reCAPTCHA checks on every comment submission path. A logged-in user can bypass the anti-spam check an administrator set up for the WordPress comment form.","severity":"medium","cvss":4.3,"epss":0.0032,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","profile-builder","self-hosted","wordpress"],"not_affected_if":["default-config","no-recaptcha-for-comments"],"how_to_check":"- Check the installed Profile Builder version in the WordPress admin plugins list or with `wp plugin get profile-builder --field=version`\n- Confirm whether reCAPTCHA is enabled for comments in the Profile Builder settings","fix":"- Update Profile Builder to a version later than `4.0.4`; the sources do not name the exact fixed release\n- Until updated, disable the plugin's comment-form reCAPTCHA reliance or add a separate anti-spam layer","status":"open","published_at":"2026-10-23T12:18:09+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T04:37:20+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:37:20Z","model":"claude-haiku-5-5","output":{"fix":"- Update Profile Builder to a version later than `4.0.4`; the sources do not name the exact fixed release\n- Until updated, disable the plugin's comment-form reCAPTCHA reliance or add a separate anti-spam layer","reach":"internet","title":"Profile Builder WordPress plugin: reCAPTCHA skipped on some comment paths","impact":"low","summary":"The Profile Builder WordPress plugin versions 4.0.0 through 4.0.4 do not enforce reCAPTCHA checks on every comment submission path. A logged-in user can bypass the anti-spam check an administrator set up for the WordPress comment form.","category":"package","nicknames":[],"who_cares":["wordpress","profile-builder","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Authenticated users post comments without the configured reCAPTCHA check","analyst_note":"","how_to_check":"- Check the installed Profile Builder version in the WordPress admin plugins list or with `wp plugin get profile-builder --field=version`\n- Confirm whether reCAPTCHA is enabled for comments in the Profile Builder settings","needs_analyst":false,"not_affected_if":["default-config","no-recaptcha-for-comments"],"who_is_affected":"WordPress sites running Profile Builder 4.0.0 through 4.0.4 that rely on its reCAPTCHA to stop comment spam. The issue only lets authenticated users skip that check, so sites that allow no user logins or that do not use reCAPTCHA for comments are less exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000624,"input_tokens":3322,"output_tokens":583,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111965':13A,16A '-2026':12A,15A '4.0.0':31B,71C '4.0.4':33B,73C 'administr':57B,96C 'allow':85C 'anti':53B,92C 'anti-spam':52B,91C 'authent':86C 'builder':2A,20B,27B,67C 'bypass':50B,89C 'check':38B,55B 'comment':9A,41B,63B,82C,101C 'configur':97C 'cve':11A,14A 'enforc':36B,76C 'everi':40B 'form':64B,102C 'host':23B 'log':46B 'logged-in':45B 'packag':17B 'path':10A,43B,84C 'plugin':4A,29B,69C 'profil':1A,19B,26B,66C 'profile-build':18B 'protect':94C 'recaptcha':5A,37B,78C 'self':22B 'self-host':21B 'set':58B 'skip':6A 'spam':54B,93C 'submiss':42B,83C 'user':48B,87C 'verif':79C 'version':30B 'wordpress':3A,24B,28B,62B,68C,100C","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running Profile Builder 4.0.0 through 4.0.4 that rely on its reCAPTCHA to stop comment spam. The issue only lets authenticated users skip that check, so sites that allow no user logins or that do not use reCAPTCHA for comments are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T12:18:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"contact@wpscan.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111965","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111965","severity":null,"published_at":"2026-10-23T12:18:09+00:00","modified_at":"2026-10-23T14:20:57+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-111965","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111965","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}