CVE-2024-12034CWE-340

Advanced Google reCAPTCHA <= 1.25 - Brute Force Protection IP Unblock

Medium · published December 24, 2024

CVSS v3.1
5.3
EPSS
0%
Percentile
27.4
In the wild
Unconfirmed
What it is

The Advanced Google reCAPTCHA plugin for WordPress is vulnerable to IP unblocking in all versions up to, and including, 1.25. This is due to the plugin not utilizing a strong unique key when generating an unblock request. This makes it possible for unauthenticated attackers to unblock their IP after being locked out due to too many bad password attempts

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00349 · 27.4th percentile
Weakness
CWE-340 · Generation of Predictable Numbers or Identifiers
Published
2024-12-24T05:23Z
EPSS history
Timeline
  • 24 DEC 05:23Z
    Advanced Google reCAPTCHA <= 1.25 - Brute Force Protection IP Unblock
    cvelistv5