Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

ajax-bootmodal-login allows unlimited actions after one CAPTCHA

CVE-2018-15876 · published 8 years ago
Summary

The ajax-bootmodal-login plugin for WordPress (version 1.4.3) only checks the CAPTCHA once per user session. After that, an attacker can automate unlimited registrations, logins, or password resets without solving the CAPTCHA again. Update the plugin or add additional rate‑limiting and CAPTCHA checks to each request.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
ajax_bootmodal_login_project ajax_bootmodal_login 1.4.3
cpe:2.3:a:ajax_bootmodal_login_project:ajax_bootmodal_login:1.4.3:*:*:*:*:*:*:*
Original advisory text
An issue was discovered in the ajax-bootmodal-login plugin 1.4.3 for WordPress. The register form, login form, and password-recovery form require solving a CAPTCHA to perform actions. However, this...
An issue was discovered in the ajax-bootmodal-login plugin 1.4.3 for WordPress. The register form, login form, and password-recovery form require solving a CAPTCHA to perform actions. However, this is required only once per user session, and therefore one could send as many requests as one wished by automation.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-20Improper Input Validation
Timeline
Published26 Aug 2018
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2018-15876 · NVD
Track software like this
Free during beta