CVE-2026-32469 describes an authentication bypass vulnerability in the CAPTCHA 4WP plugin for WordPress, affecting versions up to 7.6.0. The issue allows unauthenticated attackers to bypass CAPTCHA protections by spoofing authentication, potentially enabling them to circumvent security controls that rely on CAPTCHA verification. The vulnerability is categorized as CWE-290, indicating a failure in authentication mechanisms. The CVSS v3.1 base score is 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No vendor advisory or patch information is currently available.

The vulnerability allows attackers to bypass CAPTCHA protections without authentication, which could lead to increased risk of automated abuse or spam on affected sites. However, it does not impact confidentiality or availability, only integrity to a limited extent. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing additional security controls to mitigate automated abuse risks. Monitor for vendor updates regarding patches or official mitigations.