CVE-2026-1369 - Vulnerability Details - OpenCVE

The Conditional CAPTCHA WordPress plugin through 4.0.0 does not validate a parameter before redirecting the user to its value, leading to an Open Redirect issue

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact partial

Vendors	Products
Conditional Captcha	Conditional Captcha
Wordpress	Wordpress

No data.

No data.

References

Link	Providers
https://wpscan.com/vulnerability/5a275725-85f2-4463-880b-9473dbdfa8e0/

History

Mon, 23 Feb 2026 19:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-601
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 23 Feb 2026 15:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Conditional Captcha Conditional Captcha conditional Captcha Wordpress Wordpress wordpress
Vendors & Products		Conditional Captcha Conditional Captcha conditional Captcha Wordpress Wordpress wordpress

Sun, 22 Feb 2026 06:15:00 +0000

Type	Values Removed	Values Added
Description		The Conditional CAPTCHA WordPress plugin through 4.0.0 does not validate a parameter before redirecting the user to its value, leading to an Open Redirect issue
Title		Conditional CAPTCHA <= 4.0.0 - Open Redirect
References		https://wpscan.com/vulnerability/5a275725-85f2-4463-880b-9473dbdfa8e0/

MITRE

Status: PUBLISHED

Assigner: WPScan

Published: 2026-02-22T06:00:02.222Z

Updated: 2026-02-23T18:19:58.115Z

Reserved: 2026-01-23T13:59:57.486Z

Link: CVE-2026-1369

Vulnrichment

Updated: 2026-02-23T18:19:15.732Z

NVD

Status : Awaiting Analysis

Published: 2026-02-22T06:16:02.537

Modified: 2026-02-23T19:22:58.170

Link: CVE-2026-1369

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1369", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2026-01-23T13:59:57.486Z", "datePublished": "2026-02-22T06:00:02.222Z", "dateUpdated": "2026-02-23T18:19:58.115Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-02-22T06:00:02.222Z"}, "title": "Conditional CAPTCHA <= 4.0.0 - Open Redirect", "problemTypes": [{"descriptions": [{"description": "CWE-601 URL Redirection to Untrusted Site ('Open Redirect')", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "Conditional CAPTCHA", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThanOrEqual": "4.0.0"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "The Conditional CAPTCHA WordPress plugin through 4.0.0 does not validate a parameter before redirecting the user to its value, leading to an Open Redirect issue"}], "references": [{"url": "https://wpscan.com/vulnerability/5a275725-85f2-4463-880b-9473dbdfa8e0/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Bob Matyas", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-601", "lang": "en", "description": "CWE-601 URL Redirection to Untrusted Site ('Open Redirect')"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-02-23T18:19:53.655791Z", "id": "CVE-2026-1369", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-23T18:19:58.115Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-1369", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-23T18:19:53.655791Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-601", "description": "CWE-601 URL Redirection to Untrusted Site ('Open Redirect')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-23T18:19:15.732Z"}}], "cna": {"title": "Conditional CAPTCHA <= 4.0.0 - Open Redirect", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Bob Matyas"}, {"lang": "en", "type": "coordinator", "value": "WPScan"}], "affected": [{"vendor": "Unknown", "product": "Conditional CAPTCHA", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.0.0"}], "defaultStatus": "affected"}], "references": [{"url": "https://wpscan.com/vulnerability/5a275725-85f2-4463-880b-9473dbdfa8e0/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "x_generator": {"engine": "WPScan CVE Generator"}, "descriptions": [{"lang": "en", "value": "The Conditional CAPTCHA WordPress plugin through 4.0.0 does not validate a parameter before redirecting the user to its value, leading to an Open Redirect issue"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-601 URL Redirection to Untrusted Site ('Open Redirect')"}]}], "providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-02-22T06:00:02.222Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1369", "state": "PUBLISHED", "dateUpdated": "2026-02-23T18:19:58.115Z", "dateReserved": "2026-01-23T13:59:57.486Z", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "datePublished": "2026-02-22T06:00:02.222Z", "assignerShortName": "WPScan"}, "dataVersion": "5.2"}