Captcha Code < 3.33 - Unauthenticated Login Captcha Protection Bypass

Description

The plugin is vulnerable to Bypass Vulnerability. This is due to use of the login_redirect filter to enforce captcha validation after authentication succeeds rather than the authenticate filter, allowing authentication to complete before the captcha check could block access. This makes it possible for unauthenticated attackers to bypass the login form captcha and authenticate without solving the challenge, enabling brute-force or unauthorized access to user accounts.