CVE-2026-10552 describes a CSRF vulnerability in the jotis Blue Captcha WordPress plugin versions up to and including 2.0.1. The plugin's main admin panel and certain subpages accept 'blcap_action' or 'action' parameters from $_REQUEST and execute destructive functions like plugin uninstallation, log deletion, Hall of Shame entry removal, and IP banning without any nonce verification (no wp_verify_nonce(), check_admin_referer(), or check_ajax_referer() calls). This lack of proper nonce validation enables unauthenticated attackers to perform these actions by tricking an administrator into clicking a crafted link or visiting a malicious page.

An attacker can cause an administrator to unknowingly uninstall the Blue Captcha plugin, delete audit logs, remove Hall of Shame entries, or add arbitrary IP addresses to the block list. This compromises the integrity and availability of the plugin's security features and audit data, potentially weakening the site's defense against malicious traffic. There is no direct confidentiality impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking on untrusted links while logged into the WordPress admin panel. Monitoring for suspicious changes to the plugin or its logs may help detect exploitation attempts. Implementing additional security controls such as web application firewalls or custom nonce verification could mitigate risk.