Vulnerabilities and security researches foradvanced-google-recaptcha advanced-google-recaptcha

Dec 25, 2024

CVE, Research URL: CVE-2024-12034
Home page URL: Security reports for Advanced Google reCAPTCHA
Application: Advanced Google reCAPTCHA
Date: Dec 24, 2024
Research Description: The Advanced Google reCAPTCHA plugin for WordPress is vulnerable to IP unblocking in all versions up to, and including, 1.25. This is due to the plugin not utilizing a strong unique key when generating an unblock request. This makes it possible for unauthenticated attackers to unblock their IP after being locked out due to too many bad password attempts
Affected versions: max 1.26.
Status: vulnerable

Feb 28, 2025

CVE, Research URL: CVE-2025-1262
Home page URL: Security reports for Advanced Google reCAPTCHA
Application: Advanced Google reCAPTCHA
Date: Feb 25, 2025
Research Description: The Advanced Google reCaptcha plugin for WordPress is vulnerable to CAPTCHA Bypass in versions up to, and including, 1.27 . This makes it possible for unauthenticated attackers to bypass the Built-in Math Captcha Verification.
Affected versions: max 1.28.
Status: vulnerable

Apr 02, 2025

CVE, Research URL: CVE-2025-2074
Home page URL: Security reports for Advanced Google reCAPTCHA
Application: Advanced Google reCAPTCHA
Date: Mar 28, 2025
Research Description: The Advanced Google reCAPTCHA plugin for WordPress is vulnerable to generic SQL Injection via the ‘sSearch’ parameter in all versions up to, and including, 1.29 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries, particularly when the plugin’s settings page hasn’t been visited and its welcome message has not been dismissed. This issue can be used to extract sensitive information from the database.
Affected versions: max 1.30.
Status: vulnerable