CVE-2026-1075: 
WordPress vulnerability analysis and mitigation

CVE-2026-1075 is a Cross-Site Request Forgery (CSRF) vulnerability in the ZT Captcha plugin for WordPress, affecting all versions up to and including 1.0.4. The flaw allows unauthenticated attackers to modify plugin settings by tricking a site administrator into clicking a malicious link. It was reported by Wordfence and published on January 24, 2026. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium) (Wordfence, RedHat CVE).

The root cause is improper nonce validation (CWE-352) in the save_ztcpt_captcha_settings action handler within CaptchaRequest.php (line 37). Specifically, the nonce check can be bypassed by submitting an empty token value, effectively nullifying WordPress's built-in CSRF protection mechanism. An attacker crafts a forged HTTP request targeting this action and socially engineers a logged-in administrator to trigger it — for example, by embedding the request in a malicious webpage or link. No authentication is required on the attacker's side; only the victim's authenticated session is needed (Wordfence, ZT Captcha Source).

Successful exploitation allows an attacker to modify the ZT Captcha plugin's settings on the affected WordPress site, potentially disabling or misconfiguring CAPTCHA protections. This could expose the site to automated spam, brute-force login attempts, or bot-driven form abuse that the CAPTCHA was intended to prevent. The impact is limited to integrity (no confidentiality or availability impact), and exploitation is constrained to the plugin's configuration scope without direct code execution or data exfiltration (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-1075. The EPSS score is approximately 0.02%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires social engineering of a site administrator, which raises the practical bar for attackers (Feedly).

1. Reconnaissance: Identify WordPress sites running the ZT Captcha plugin version 1.0.4 or earlier, using tools like WPScan or by inspecting publicly accessible plugin metadata.
2. Craft malicious request: Construct an HTTP POST request targeting the save_ztcpt_captcha_settings action with an empty nonce value (e.g., nonce=) and desired malicious plugin settings as POST parameters.
3. Embed in attack vector: Host the forged request in a malicious HTML page (e.g., an auto-submitting form) or encode it in a link that triggers the request when visited.
4. Social engineering: Trick a logged-in WordPress administrator into visiting the malicious page or clicking the link — for example, via phishing email or a comment on a forum.
5. Settings modified: The administrator's browser submits the forged request with their authenticated session cookie; the plugin processes it due to the bypassed nonce check, applying the attacker-specified settings (Wordfence, ZT Captcha Source).

• Logs: WordPress access logs showing unexpected POST requests to the admin-ajax endpoint or admin settings pages with the action=save_ztcpt_captcha_settings parameter and an empty or missing nonce field.
• Application: Unexpected changes to ZT Captcha plugin settings in the WordPress admin panel (e.g., CAPTCHA disabled or reconfigured) without corresponding administrator activity.
• Network: HTTP POST requests originating from an administrator's IP to the WordPress admin endpoint shortly after the administrator visited an external or unfamiliar URL.

Users should update the ZT Captcha plugin to a version beyond 1.0.4 that includes a proper nonce validation fix. Until a patched version is available, administrators should consider deactivating the plugin or restricting access to the WordPress admin area via IP allowlisting. General hardening measures include training administrators to avoid clicking unsolicited links while logged into WordPress, and enabling a web application firewall (WAF) such as Wordfence to detect and block CSRF attempts (Wordfence).

The vulnerability was discovered and disclosed by Wordfence, which published the advisory on January 24, 2026. No significant broader media coverage or notable researcher commentary beyond the initial Wordfence disclosure has been identified. The CVE record is noted as not being prioritized for NVD enrichment due to resource constraints (Wordfence).