Hello viewers. This is Nick (aka nant) - one of the original (not the forked Russian version) CB Captcha plugin developers. We are responsible for version 2.2 that is referenced in the report. Some facts for those reading: MustLive notified us on 13.4.2010 - that's 13 days after disclosure. This should not be classified as any kind of vulnerability as there is no way that any harm can be done to a website using this script. The CB Captcha 2.2 plugin, as all similar Captcha scripts, are used to insure that human intervention is needed. The "bug" (at best) reported only allows a single user seeing the generated Captcha image, to use its code during the active session period. There is no harm that can be done to the system using this. Thus while this is a bit of odd behavior it does not represent a asecurity flaw. This will be fixed however as soon as possible. Thank you.
