CVE-2026-10552 describes a CSRF vulnerability in the Blue Captcha WordPress plugin (versions up to and including 2.0.1). The vulnerability arises because the plugin's main admin panel and certain subpages accept parameters from $_REQUEST to perform sensitive operations without implementing nonce verification functions like wp_verify_nonce(), check_admin_referer(), or check_ajax_referer(). Consequently, an attacker can craft malicious requests that, if executed by an authenticated administrator, result in destructive actions such as plugin uninstallation, audit log deletion, Hall of Shame entry removal, and modification of the banned IP list.

An attacker can cause integrity impacts by forcing an administrator to perform unauthorized actions that alter plugin state and data. These include uninstalling the plugin, deleting audit logs, removing Hall of Shame entries, and adding arbitrary IP addresses to the block list. There is no direct confidentiality or availability impact reported. The attack requires tricking an authenticated administrator into executing the malicious request (UI:R).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking on untrusted links while logged into the WordPress admin panel and consider restricting access to the plugin's admin pages. Implementing nonce verification in the plugin code is necessary to fully mitigate this vulnerability once a patch is released.