CVE-2022-2913CWE-639

Login No Captcha reCAPTCHA < 1.7 - IP Check Bypass

Medium · published September 16, 2022

CVSS v3.1
4.3
EPSS
1%
Percentile
54.7
In the wild
Unconfirmed
What it is

The Login No Captcha reCAPTCHA WordPress plugin before 1.7 doesn't check the proper IP address allowing attackers to spoof IP addresses on the allow list and bypass the need for captcha on the login screen.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00757 · 54.7th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2022-09-16T08:40Z
EPSS history
Timeline
  • 16 SEP 08:40Z
    Login No Captcha reCAPTCHA < 1.7 - IP Check Bypass
    cvelistv5