CouchCMS CVE-2025-15005

The vulnerability requires that the affected CouchCMS installation uses the reCAPTCHA Handler with the default or example configuration containing hard-coded keys rather than dynamically configured credentials. Exploitation is conditional on the attacker obtaining knowledge of the specific K_RECAPTCHA_SITE_KEY and K_RECAPTCHA_SECRET_KEY values used by the target installation-either through exposure of the config.example.php file, source code disclosure, or other information leakage. The attack is limited to remote network access (no special authentication required) but has high complexity due to the requirement to obtain the specific key material and understand the reCAPTCHA validation logic. The impact is further limited to information disclosure and potential CAPTCHA bypass; no direct code execution, data exfiltration, or system compromise is possible through this vector alone.

This vulnerability presents a low real-world risk despite publicly available exploit code. The CVSS 4.0 vector indicates network accessibility (AV:N) but requires high attack complexity (AC:H), no special circumstances (AT:N), and results only in low confidentiality impact (VC:L) with no integrity or availability impact. The EPSS score of 0.06% (20th percentile) confirms low exploitation likelihood in practice. While the vulnerability is characterized as having high exploitation difficulty and the description notes complex attack requirements, the availability of public POC code elevates concern for targeted attacks. The attack does not require authentication (PR:N) or user interaction (UI:N), meaning network-accessible instances are theoretically vulnerable if an attacker can manipulate the configuration or intercept the key material. However, the practical impact is limited to information disclosure against the reCAPTCHA mechanism itself rather than RCE or data breach. The discrepancy between public POC availability and low EPSS suggests the exploit requires specific deployment conditions or detailed knowledge of the target system's configuration.

An attacker discovers a publicly accessible or leaked copy of a CouchCMS installation's couch/config.example.php file, extracting the hard-coded K_RECAPTCHA_SITE_KEY and K_RECAPTCHA_SECRET_KEY values. Using this information and the publicly available exploit code, the attacker could generate valid reCAPTCHA responses to bypass CAPTCHA protection on forms protected by this key pair, enabling account enumeration, credential brute-forcing, or automated form submission attacks.