CVE-2026-108686lowCWE-200

CVE-2026-108686: low-severity vulnerability in WP Post Author

WP Post Author < 4.2.0 - Unauthenticated reCAPTCHA Secret Key Disclosure

Published

Follow this CVE+ Monitor wp-post-author

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 3.7epss 0.2%
The WP Post Author WordPress plugin before 4.2.0 does not restrict the integration settings it returns to visitors, allowing unauthenticated users to read the reCAPTCHA secret key when one has been saved.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
Unknown · WP Post Author
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — WP Post Author

In the same product, most dangerous first.

CVE-2026-108685LOWWP Post Author < 4.2.0 - Unauthenticated Modification of the First User Account's Profile FieldsEPSS 0.3%