RafflePress EUVD-2026-91196

Exploitation requires a target RafflePress giveaway that is both active (published/public-facing) AND has reCAPTCHA configured - the secret key is only embedded in the settings of such giveaways; sites running the plugin without reCAPTCHA-enabled active giveaways are not exposed even on vulnerable versions (before 1.12.27). When that condition holds, no further prerequisites exist: unauthenticated visitors can retrieve the key directly from the public giveaway page with no authentication, no user interaction, and no non-default tooling. The primary limiting factor is therefore configuration-dependent exposure (reCAPTCHA must be set up on a live giveaway), not access control.

This is a moderate-severity information disclosure flaw (CVSS 5.3) whose signals are internally consistent but point to limited real-world urgency. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the leak is reachable remotely by unauthenticated visitors with no interaction and low complexity, which raises exposure, but the impact is narrowly scoped to confidentiality only (C:L/I:N/A:N) - the single artifact exposed is the reCAPTCHA secret key, not site or user data. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so exploitation status is 'no public exploit identified at time of analysis'; there is no evidence of active exploitation. The practical consequence of a leaked reCAPTCHA secret is degraded bot protection (an attacker can forge/validate reCAPTCHA responses or abuse the key), not direct compromise, which is why this correctly rates medium rather than critical despite the unauthenticated network vector. This is a real but low-priority issue: patch in routine cycles rather than emergency. Note a scoping condition the raw CVSS does not capture - the leak only materializes for giveaways that are both active and have reCAPTCHA configured, so sites without that configuration are unaffected even on vulnerable versions.

An unauthenticated attacker browses to a public giveaway page served by a vulnerable RafflePress installation and inspects the embedded giveaway settings in the page source or associated API/JSON output, where the reCAPTCHA secret key is exposed. The attacker extracts the secret key and can then forge or validate reCAPTCHA tokens, undermining the bot/spam protection the site relies on. No authentication, user interaction, or special tooling is required given the AV:N/AC:L/PR:N/UI:N vector, though no public exploit code has been identified.