EUVD-2026-93069
GHSA-9vfj-8pvp-mccw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach reCAPTCHA-protected endpoint over network
-
ExploitCraft request bypassing verification logic
-
ExecutionSubmit form without valid reCAPTCHA token
-
ImpactDefeat anti-automation integrity control
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Alternate path authentication
|
| Exploitation Conditions | Exploitation requires that the target WordPress site has the Advanced Google reCAPTCHA plugin (version 5.40 or earlier) installed and active on a reachable form or authentication endpoint; the flaw affects the plugin's reCAPTCHA verification logic rather than the WordPress core. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, user interaction, or special privileges are needed, so there are few limiting factors beyond the plugin being present and the vulnerable version being deployed. The primary limiter is footprint: only sites running this specific plugin at <=5.40 are affected, and impact is confined to integrity of the anti-bot control (I:L) with no confidentiality or availability effect. |
| Impact | This is a moderate-severity (CVSS 5.3) broken-authentication flaw (CWE-288) in the Advanced Google reCAPTCHA WordPress plugin, reported by Patchstack. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated issue requiring no user interaction, but the impact is deliberately narrow: integrity-only and low (C:N/I:L/A:N), with unchanged scope. In practice this means an attacker can bypass or subvert the reCAPTCHA authentication/verification mechanism rather than take over the host - consistent with a plugin whose job is to gate forms against bots. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence, so there is no evidence of active exploitation or weaponization; this reads as a real-but-low-urgency hygiene issue rather than an emergency. One signal conflict to note: the input Tags include 'Information Disclosure', yet the CVSS vector sets C:N (no confidentiality impact) and only I:L - the labeled impact category does not match the scored impact, so the actual consequence (defeating bot/spam protection) should be confirmed against the Patchstack advisory rather than treated as data leakage. |
| Exploit ScenarioDerived | An unauthenticated remote attacker crafts requests to a form or endpoint protected by the Advanced Google reCAPTCHA plugin (<=5.40) and bypasses the reCAPTCHA verification step, allowing automated submissions that the plugin was meant to block. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, this requires only network access and no credentials or user interaction. No public proof-of-concept was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Unauthenticated attackers can defeat the Google reCAPTCHA verification performed by the Advanced Google reCAPTCHA WordPress plugin (versions up to and including 5.40), allowing anti-bot/authentication checks on protected forms to be bypassed. The flaw is a CWE-288 authentication bypass using an alternate path or channel, rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), so no credentials, privileges, or user interaction are required and impact is limited to the integrity of the CAPTCHA control with no confidentiality or availability effect. Exploitation is constrained mainly by footprint - only WordPress sites running the vulnerable plugin version on a reachable form or authentication endpoint are affected - and no public exploit is identified at time of analysis.
RemediationAI
No vendor-released patch version is identified in the available data at time of analysis, so administrators should first check the plugin's WordPress.org page and the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/advanced-google-recaptcha/vulnerability/wordpress-advanced-google-recaptcha-plugin-5-40-broken-authentication-vulnerability) for an updated release and upgrade Advanced Google reCAPTCHA beyond 5.40 as soon as a fixed build is published. If no fix is yet available, the most direct compensating control is to deactivate the plugin, but this has the obvious side effect of removing reCAPTCHA protection from all forms and authentication endpoints it was guarding, which may expose those endpoints to automated abuse; plan to replace it with an alternative, actively maintained CAPTCHA or anti-bot plugin rather than leaving endpoints unprotected. As an interim measure, place the affected forms and WordPress login/registration endpoints behind a reverse-proxy or WAF rule that performs server-side validation of reCAPTCHA tokens or enforces rate limiting, accepting the trade-off of additional configuration complexity and possible false positives for legitimate users. Because the flaw requires no authentication and no user interaction, restricting or temporarily disabling public-facing form submissions on high-value sites (for example, disabling user registration or comment submission) is a defensible short-term step, at the cost of reduced site functionality. Monitor web and application logs for anomalous form submissions, spam registrations, or repeated CAPTCHA-failure patterns that would indicate attempted exploitation of the bypass, and re-check the Patchstack and EUVD entries for a patched plugin version.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Advanced Google reCAPTCHA plugin for WordPress, published by the vendor tracked as 'webfactory' in the CPE string cpe:2.3:a:webfactory:advanced_google_recaptcha:*:*:*:*:*:*:*:*. WordPress plugins are PHP applications that hook into WordPress actions and filters; this plugin's role is to add Google reCAPTCHA challenges to WordPress forms and authentication endpoints and to validate the resulting token server-side before allowing the protected action. CWE-288 (Authentication Bypass Using an Alternate Path or Channel) indicates the root cause is that the plugin's verification logic can be reached or satisfied through a route that does not perform the intended reCAPTCHA validation - for example, a code path where the verification result is trusted, skipped, or short-circuited - so the check that is supposed to gate the action can be circumvented without a valid reCAPTCHA response. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N confirms this is remotely reachable over the network with low complexity, requires no authentication (PR:N) and no user interaction (UI:N), and yields only a low integrity impact confined to the scope of the vulnerable component; there is no confidentiality or availability impact in the assessed vector. The CPE wildcard version and the EUVD entry EUVD-2026-93069 both identify the Advanced Google reCAPTCHA plugin at version 5.40 or earlier as the affected code base.
Know when Advanced Google Recaptcha gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Unauthenticated network-reachable verification bypass (AV:N/AC:L/PR:N/UI:N) with integrity-only low impact (I:L); no confidentiality or availability effect and unchanged scope.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Broken Authentication in Advanced Google reCAPTCHA <= 5.40 versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Advanced Google Recaptcha
View allRemote code execution in WP Captcha PRO (premium version of the Advanced Google reCAPTCHA WordPress plugin) through vers
Authentication bypass in WP Captcha PRO (and the free Advanced Google reCAPTCHA plugin sharing the same slug) for WordPr
The Advanced Google reCaptcha plugin for WordPress is vulnerable to CAPTCHA Bypass in versions up to, and including, 1.2
Exploit-DB