Blue Captcha <= 2.0.1 - Cross-Site Request Forgery via 'blcap_action' Parameter

An unauthenticated attacker can craft a forged request that triggers plugin uninstallation, log deletion, Hall of Shame deletion, or addition of arbitrary IP addresses to the banned list. The attacker must trick a logged-in site administrator into clicking a malicious link or visiting a crafted page, exploiting the missing CSRF protection [ref_id=1]. No authentication is required for the attacker, only the victim administrator must be authenticated.

The vulnerability resides in the main admin panel (`blcap_main_page`), the Hall of Shame subpage (`blcap_hos_page`), and the Log subpage (`blcap_logs_page`). These pages accept a `blcap_action` or `action` parameter from `$_REQUEST` and call destructive functions such as `blcap_uninstall()`, `blcap_delete_logs()`, and `blcap_delete_ip_db()` without any nonce verification. The entire codebase lacks calls to `wp_verify_nonce()`, `check_admin_referer()`, or `check_ajax_referer()` [ref_id=1].

The advisory states that the plugin fails to implement any nonce validation on its admin actions. To fix the vulnerability, the plugin must add `wp_verify_nonce()` or `check_admin_referer()` calls before executing destructive operations such as `blcap_uninstall()`, `blcap_delete_logs()`, and `blcap_delete_ip_db()`. No patch is provided in the bundle.