{"id":"CVE-2026-108686","aliases":[],"cve":{"records":[{"id":"CVE-2026-108686","source":"WPScan","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-10T22:33:32.817Z","published":"2026-10-29T06:00:24.208Z","modified":"2026-10-29T10:56:07.495Z"}],"publishers":[{"name":"WPScan","role":"CNA","organizationId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","modified":"2026-10-29T06:00:24.208Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-29T10:56:07.495Z"}],"references":[{"url":"https://wpscan.com/vulnerability/50b39d25-51dc-49b4-8480-6a6954af8209/","tags":["exploit","vdb-entry","technical-description"],"source":"WPScan"}],"weaknesses":[{"id":"CWE-200","description":"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor","source":"CISA-ADP"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-29T10:51:08.162797Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"WP Post Author < 4.2.0 - Unauthenticated reCAPTCHA Secret Key Disclosure","titleSource":"WPScan","descriptionSource":"WPScan","description":"The WP Post Author  WordPress plugin before 4.2.0 does not restrict the integration settings it returns to visitors, allowing unauthenticated users to read the reCAPTCHA secret key when one has been saved.","score":3.7,"severity":"low","published":"2026-10-29T06:00:24.208Z","modified":"2026-10-29T10:56:07.495Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Unknown","name":"WP Post Author","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"4.2.0","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"WPScan","url":"https://www.cve.org/CVERecord?id=CVE-2026-108686"}],"remediation":[],"references":["https://wpscan.com/vulnerability/50b39d25-51dc-49b4-8480-6a6954af8209/"],"sources":[{"name":"CVE","id":"CVE-2026-108686","modified":"2026-10-29T10:56:07.495Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-108686"}],"assessments":[{"source":"CISA-ADP","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","score":3.7}],"sourceAffected":[],"observedAt":"2026-10-29T14:27:11.391Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T04:10:31.776Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-29T07:15:34.208Z","attemptedAt":"2026-10-29T07:15:34.208Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-29T07:15:34.206Z","attemptedAt":"2026-10-29T07:15:34.206Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-29T07:15:33.474Z","attemptedAt":"2026-10-29T07:15:33.474Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-29T07:15:32.753Z","attemptedAt":"2026-10-29T07:15:32.753Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-112619","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-112619","modified":"Oct 29, 2026, 6:30:37 AM","checkedAt":"2026-10-29T07:15:33.474Z"},{"source":"GitHub Advisory Database","id":"GHSA-9288-h947-8qw5","url":"https://github.com/advisories/GHSA-9288-h947-8qw5","modified":"2026-10-29T06:30:43Z","checkedAt":"2026-10-29T07:15:34.206Z"},{"source":"NVD","id":"CVE-2026-108686","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108686","modified":"2026-10-29T06:17:17.583","checkedAt":"2026-10-29T07:15:34.208Z"}],"aiSummary":{"text":"The WP Post Author WordPress plugin before version 4.2.0 discloses the reCAPTCHA secret key to unauthenticated users. This is due to a lack of restriction on integration settings returned to visitors. The impact is exposure of sensitive information.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T08:39:17.336Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-108686"}]}}