Successful exploitation requires that the CAPTCHA is displayed by e.g. logging in several times using a valid username.
Related posts