What the vulnerability does
01Description
The Ibtana – WordPress Website Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ibtana_visual_editor_register_ajax_json_endpont' function in all versions up to, and including, 1.2.3.3. This makes it possible for unauthenticated attackers to update option values for reCAPTCHA keys on the WordPress site. This can be leveraged to bypass reCAPTCHA on the site. CVE-2024-37123 is likely a duplicate of this issue.
Explanation of Vulnerability in Simple Terms
02Summary
The Ibtana WordPress Website Builder plugin through version 1.2.3.3 lacks proper authorization checks on certain functions. An unauthenticated attacker can modify site data without permission. The vulnerability requires only network access and no user interaction. Site administrators should update the plugin immediately to prevent unauthorized changes.
What an attacker can do
03Attacker Capabilities
Modify site data without authentication or permission.
Potential impact on your site
04Site Impact
Attackers can alter your site's content or settings without logging in.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
June 18, 2024
CVE published
April 8, 2026
Record updated
