CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Advanced Google reCaptcha plugin for WordPress is vulnerable to CAPTCHA Bypass in versions up to, and including, 1.27 . This makes it possible for unauthenticated attackers to bypass the Built-in Math Captcha Verification.
Explanation of Vulnerability in Simple Terms
Advanced Google reCAPTCHA versions 1.27 and earlier contain an integrity vulnerability that allows network-based attacks without authentication. An attacker can modify data in transit, though the specific impact depends on how the plugin processes reCAPTCHA responses. No user interaction is required. Update to a version newer than 1.27.
What an attacker can do
Modify reCAPTCHA validation data in transit to bypass or manipulate form submissions.
Potential impact on your site
Form submissions protected by this plugin may be bypassed or manipulated by attackers without triggering reCAPTCHA validation.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
