Is there a public PoC exploit available for CVE-2025-15005?

Yes, a public proof-of-concept exploit is available for CVE-2025-15005. Prioritise patching immediately. EPSS: 0.1%.

CouchCMS CVE-2025-15005

Q: What is the CVSS score of CVE-2025-15005?

CVE-2025-15005 has a CVSS 4.0 base score of 2.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

LOW

Key Management Errors (CWE-320)

2025-12-22 cna@vuldb.com

PHP Information Disclosure Couchcms

2.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.9 LOW

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 02:49 vuln.today

DescriptionCVE.org

A security flaw has been discovered in CouchCMS up to 2.4. Affected is an unknown function of the file couch/config.example.php of the component reCAPTCHA Handler. The manipulation of the argument K_RECAPTCHA_SITE_KEY/K_RECAPTCHA_SECRET_KEY results in use of hard-coded cryptographic key . It is possible to launch the attack remotely. This attack is characterized by high complexity. The exploitability is told to be difficult. The exploit has been released to the public and may be used for attacks.

AnalysisAI

CouchCMS versions up to 2.4 use hard-coded cryptographic keys in the reCAPTCHA handler configuration, allowing remote attackers with high complexity to conduct information disclosure attacks against the reCAPTCHA mechanism. The vulnerability stems from improper handling of K_RECAPTCHA_SITE_KEY and K_RECAPTCHA_SECRET_KEY parameters in couch/config.example.php, and publicly available exploit code exists, though real-world exploitation probability remains low (EPSS 0.06%).

Technical ContextAI

CouchCMS implements reCAPTCHA integration through a configuration file (couch/config.example.php) that handles the reCAPTCHA API keys. The vulnerability occurs in the reCAPTCHA Handler component, which processes K_RECAPTCHA_SITE_KEY and K_RECAPTCHA_SECRET_KEY arguments. The underlying issue is CWE-320 (Key Management Errors), specifically the use of hard-coded cryptographic keys rather than dynamically configured or securely managed credentials. This allows an attacker to predict or know the cryptographic material used to validate reCAPTCHA responses, potentially bypassing or spoofing CAPTCHA verification. The PHP-based application relies on these keys for server-side reCAPTCHA validation logic.

RemediationAI

Upgrade CouchCMS to version 2.5 or later if a patched version is available; however, patch availability has not been independently confirmed from vendor sources. As an immediate compensating control, administrators should manually configure unique and non-predictable K_RECAPTCHA_SITE_KEY and K_RECAPTCHA_SECRET_KEY values in the production couch/config.php file (not the example config), ensuring these keys are generated fresh from the Google reCAPTCHA console and never derived from example or default values. Implement environment-based configuration management where reCAPTCHA keys are stored as server environment variables or secure vaults rather than in source-controlled files. Verify that the couch/config.example.php file is not exposed to web-accessible directories and restrict file permissions to prevent unauthorized reading. Monitor reCAPTCHA challenge logs for anomalous patterns or repeated failures that might indicate exploitation attempts.