CVE-2026-1369: 
WordPress vulnerability analysis and mitigation

CVE-2026-1369 is an Open Redirect vulnerability in the Conditional CAPTCHA WordPress plugin affecting all versions through 4.0.0. The plugin fails to validate a user-supplied parameter before redirecting the user to its value, enabling attackers to redirect victims to arbitrary external URLs. It was publicly disclosed on January 31, 2026, and carries a CVSS v3.1 base score of 4.3 (Medium) (WPScan, Red Hat CVE).

The root cause is classified as CWE-601 (URL Redirection to Untrusted Site / Open Redirect). After a user solves a CAPTCHA challenge, the plugin redirects to a URL supplied via the redirect_to POST parameter without validating or sanitizing its value. An attacker can craft a malicious HTML form targeting a comment submission endpoint on a vulnerable WordPress site, embedding an arbitrary external URL in the redirect_to field; once the victim submits the form and solves the CAPTCHA, they are silently redirected to the attacker-controlled destination. Exploitation requires user interaction (the victim must submit the form and solve the CAPTCHA) but no authentication or elevated privileges (WPScan).

Successful exploitation allows an attacker to redirect authenticated or unauthenticated WordPress visitors to arbitrary external websites, facilitating phishing campaigns, credential harvesting, or malware distribution. The vulnerability has no direct impact on confidentiality or availability of the WordPress installation itself, but the integrity impact lies in the ability to abuse the site's trusted domain as a stepping stone to deceive users. There is no risk of server-side code execution or data exfiltration from the server (WPScan, Red Hat CVE).

A public proof-of-concept (PoC) is available via WPScan, demonstrating exploitation through a crafted HTML form. The EPSS score is approximately 0.017% (0.000170), indicating a low probability of widespread automated exploitation in the near term. No evidence of active in-the-wild exploitation, threat actor attribution, or CISA KEV catalog listing has been identified for this vulnerability (WPScan, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites using the wp-conditional-captcha plugin (version ≤ 4.0.0) by inspecting page source, plugin directories, or using tools like WPScan.
2. Identify target post: Navigate to a post on the target site that allows comments. View the page source to locate the comment_post_ID value embedded in the comment form's CSS classes.
3. Craft malicious HTML form: Create an HTML file with a form whose action points to the target site's comment submission URL (e.g., https://target.com/wp-comments-post.php), including fields for comment_post_ID, comment (arbitrary text), and redirect_to set to the attacker's desired destination (e.g., https://attacker-phishing-site.com).
4. Deliver to victim: Host the HTML file or send it to the victim via email or social engineering, prompting them to open and submit the form.
5. Victim solves CAPTCHA: After form submission, the victim is presented with the CAPTCHA page on the legitimate WordPress site and solves it.
6. Redirect achieved: Upon CAPTCHA submission, the plugin redirects the victim to the unvalidated redirect_to URL — the attacker-controlled site — without any warning (WPScan).

• Network: HTTP POST requests to /wp-comments-post.php containing a redirect_to parameter with an external or suspicious URL domain.
• Logs: WordPress or web server access logs showing POST requests to the comment submission endpoint followed by a 302 redirect response to an external domain not belonging to the site.
• Logs: Referrer headers in web server logs showing users arriving at external phishing or malware sites originating from the WordPress installation's CAPTCHA page.

As of the disclosure date, there is no known fix available for the Conditional CAPTCHA plugin (wp-conditional-captcha) through version 4.0.0 (WPScan). Site administrators should consider deactivating and removing the plugin until a patched version is released. As a workaround, a Web Application Firewall (WAF) rule can be configured to block or sanitize POST requests containing external URLs in the redirect_to parameter targeting the comment submission endpoint.

The vulnerability was discovered and reported by security researcher Bob Matyas, who also submitted it to WPScan (WPScan). No significant broader media coverage or notable community discussion has been identified beyond standard vulnerability database listings.