This vulnerability in CAPTCHA 4WP (versions <= 7.6.0) allows unauthenticated attackers to bypass CAPTCHA verification mechanisms by spoofing authentication controls. The issue is categorized as CWE-290, indicating an authentication bypass due to spoofing. The vulnerability has a CVSS 3.1 score of 5.3 (medium severity), with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts integrity but not confidentiality or availability. No official fix or patch has been published yet, and no known active exploitation has been reported.

An attacker can bypass CAPTCHA protections without authentication, potentially allowing automated or scripted actions that would normally be blocked by CAPTCHA verification. This could lead to integrity impacts such as unauthorized actions or submissions being accepted by the protected application. There is no impact on confidentiality or availability reported. The medium severity score reflects a moderate risk due to ease of exploitation and potential misuse.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider implementing additional verification controls or monitoring for suspicious activity related to CAPTCHA bypass attempts. Avoid relying solely on this CAPTCHA version for critical security controls.