Vulnerabilities and security researches foradvanced-google-recaptcha advanced-google-recaptcha

Dec 25, 2024

CVE, Research URL: CVE-2024-12034
Home page URL: Security reports for Advanced Google reCAPTCHA
Application: Advanced Google reCAPTCHA
Date: Dec 24, 2024
Research Description: The Advanced Google reCAPTCHA plugin for WordPress is vulnerable to IP unblocking in all versions up to, and including, 1.25. This is due to the plugin not utilizing a strong unique key when generating an unblock request. This makes it possible for unauthenticated attackers to unblock their IP after being locked out due to too many bad password attempts
Affected versions: max 1.26.
Status: vulnerable

Feb 28, 2025

CVE, Research URL: CVE-2025-1262
Home page URL: Security reports for Advanced Google reCAPTCHA
Application: Advanced Google reCAPTCHA
Date: Feb 25, 2025
Research Description: The Advanced Google reCaptcha plugin for WordPress is vulnerable to CAPTCHA Bypass in versions up to, and including, 1.27 . This makes it possible for unauthenticated attackers to bypass the Built-in Math Captcha Verification.
Affected versions: max 1.28.
Status: vulnerable

Apr 02, 2025

CVE, Research URL: CVE-2025-2074
Home page URL: Security reports for Advanced Google reCAPTCHA
Application: Advanced Google reCAPTCHA
Date: Mar 28, 2025
Research Description: The Advanced Google reCAPTCHA plugin for WordPress is vulnerable to generic SQL Injection via the ‘sSearch’ parameter in all versions up to, and including, 1.29 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries, particularly when the plugin’s settings page hasn’t been visited and its welcome message has not been dismissed. This issue can be used to extract sensitive information from the database.
Affected versions: max 1.30.
Status: vulnerable

Jun 07, 2026

CVE, Research URL: CVE-2026-5411
Home page URL: Security reports for Advanced Google reCAPTCHA
Application: Advanced Google reCAPTCHA
Date: Jun 06, 2026
Research Description: The WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug) plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 5.38. This is due to a capability check in the save_ajax() function of the licensing module, combined with unrestricted file extraction in sync_cloud_protection(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files including PHP webshells to the server by injecting a malicious cloud_protection_url into the license meta, which the plugin then downloads and extracts without file type validation into a web-accessible uploads directory. This can be used for remote code execution. Note: The vulnerability can only be exploited with a remote URL if "allow_url_fopen" is enabled in the php.ini config.
Affected versions: max 5.39.
Status: vulnerable

CVE, Research URL: CVE-2026-5415
Home page URL: Security reports for Advanced Google reCAPTCHA
Application: Advanced Google reCAPTCHA
Date: Jun 06, 2026
Research Description: The WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug) plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.38. This is due to the ajax_run_tool() AJAX handler relying solely on a nonce check (check_ajax_referer) for security without performing any capability check, combined with the create_temporary_link tool allowing the generation of passwordless login links for arbitrary users, and the handle_temporary_links() function authenticating visitors via these links without any additional authorization validation. The required nonce is exposed to all authenticated backend users (including Subscribers) via wp_localize_script() on all non-settings admin pages when the plugin's welcome pointer has not been dismissed. This makes it possible for authenticated attackers, with Subscriber-level access and above, to bypass normal authentication and log in as any user, including Administrators, resulting in complete account takeover.
Affected versions: max 5.39.
Status: vulnerable