All vulnerabilities
CVE-2026-108686

WP Post Author < 4.2.0 - Unauthenticated reCAPTCHA Secret Key Disclosure

Unknown WP Post Author
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in4.2.0Fixed versionCVE List
Published29 Oct 2026Updated 29 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The WP Post Author WordPress plugin before 4.2.0 does not restrict the integration settings it returns to visitors, allowing unauthenticated users to read the reCAPTCHA secret key when one has been saved.

Text from CVE List

Affected versions 1

  • WP Post Authoraffected: all versions before 4.2.0CVE List

References 1