---
id: CVE-2026-108686
title: WP Post Author < 4.2.0 - Unauthenticated reCAPTCHA Secret Key Disclosure
summary: >-
  The WP Post Author  WordPress plugin before 4.2.0 does not restrict the
  integration settings it returns to visitors, allowing unauthenticated users to
  read the reCAPTCHA secret key when one has been saved.
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: adp
cwe:
  - CWE-200
product: WP Post Author
affected:
  - wp_post_author < 4.2.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-29T10:51:08.162797Z'
published: '2026-10-29'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T10:56:07.495Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-108686'
references:
  - url: 'https://wpscan.com/vulnerability/50b39d25-51dc-49b4-8480-6a6954af8209/'
tags:
  - cve.org
epss: 0.00216
epssPercentile: 0.12209
ingestedAt: '2026-11-01T17:57:46.221Z'
---

## Overview

The WP Post Author  WordPress plugin before 4.2.0 does not restrict the integration settings it returns to visitors, allowing unauthenticated users to read the reCAPTCHA secret key when one has been saved.

## Affected

- `wp_post_author < 4.2.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.