Webfactory
Monthly
SQL injection in the WordPress plugin Email Log (versions ≤2.63) lets an authenticated site Administrator execute crafted SQL against the underlying database through an admin-side parameter that is concatenated into a query without sanitization. Successful abuse is primarily a confidentiality problem - exfiltration of subscriber addresses, message contents and other stored WordPress data (C:H) - with some availability risk (A:L) and no demonstrated integrity impact; the independent assessment retains scope unchanged (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L) rather than the scope-changed 7.6 originally reported, and rates it a genuine but low-urgency issue because exploitation presupposes Administrator credentials. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV entry; no EPSS data supplied by the sources reviewed), so the practical threat is a malicious or compromised admin account rather than mass remote exploitation.
Remote code execution in WP Captcha PRO (premium version of the Advanced Google reCAPTCHA WordPress plugin) through version 5.38 allows authenticated Subscriber-level attackers to upload arbitrary files, including PHP webshells, by abusing the licensing module's save_ajax() capability check and the unrestricted archive extraction in sync_cloud_protection(). No public exploit identified at time of analysis, but the CVSS 8.8 rating and trivial Subscriber-level prerequisite - common on sites with open registration - make this a high-priority WordPress ecosystem flaw. Wordfence is the original reporter and primary intelligence source.
Authentication bypass in WP Captcha PRO (and the free Advanced Google reCAPTCHA plugin sharing the same slug) for WordPress versions through 5.38 allows authenticated Subscriber-level users to log in as any account, including Administrator. The flaw chains a missing capability check in the ajax_run_tool() AJAX handler with the create_temporary_link tool that issues passwordless login links for arbitrary users, enabling full account takeover. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Unauthenticated attackers can defeat the Google reCAPTCHA verification performed by the Advanced Google reCAPTCHA WordPress plugin (versions up to and including 5.40), allowing anti-bot/authentication checks on protected forms to be bypassed. The flaw is a CWE-288 authentication bypass using an alternate path or channel, rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), so no credentials, privileges, or user interaction are required and impact is limited to the integrity of the CAPTCHA control with no confidentiality or availability effect. Exploitation is constrained mainly by footprint - only WordPress sites running the vulnerable plugin version on a reachable form or authentication endpoint are affected - and no public exploit is identified at time of analysis.
Authentication-protection bypass in the WebFactory Login Lockdown WordPress plugin at version 2.17 and earlier lets unauthenticated remote attackers evade the plugin's failed-login lockout by spoofing the client identifier it relies on to count and block attempts, enabling sustained credential brute-force against wp-login.php. The assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, score 4.8) confirms that no authentication or user interaction is required, while the HIGH attack complexity reflects the need to reliably reproduce the spoofing condition; the impact is bounded to defeating the throttling control rather than directly granting access. The issue is mapped to CWE-290 and was reported by Patchstack; there is no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis.
CAPTCHA verification bypass in the WordPress plugin Captcha Code (by webfactory) version 3.32 and earlier allows unauthenticated remote attackers to submit protected forms without solving the challenge, weakening the anti-automation control on any form the plugin guards. The assessed CVSS v3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, base 4.8) confirms no authentication or user interaction is required, but its high attack complexity indicates the bypass is not guaranteed on every attempt and the outcome is confined to defeating the CAPTCHA itself - it does not yield WordPress account access or site compromise. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is a genuinely low-priority issue despite the 'authentication bypass' framing; its real-world value depends entirely on how sensitive the forms the CAPTCHA was protecting happen to be.
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SQL injection in the WordPress plugin Email Log (versions ≤2.63) lets an authenticated site Administrator execute crafted SQL against the underlying database through an admin-side parameter that is concatenated into a query without sanitization. Successful abuse is primarily a confidentiality problem - exfiltration of subscriber addresses, message contents and other stored WordPress data (C:H) - with some availability risk (A:L) and no demonstrated integrity impact; the independent assessment retains scope unchanged (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L) rather than the scope-changed 7.6 originally reported, and rates it a genuine but low-urgency issue because exploitation presupposes Administrator credentials. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV entry; no EPSS data supplied by the sources reviewed), so the practical threat is a malicious or compromised admin account rather than mass remote exploitation.
Remote code execution in WP Captcha PRO (premium version of the Advanced Google reCAPTCHA WordPress plugin) through version 5.38 allows authenticated Subscriber-level attackers to upload arbitrary files, including PHP webshells, by abusing the licensing module's save_ajax() capability check and the unrestricted archive extraction in sync_cloud_protection(). No public exploit identified at time of analysis, but the CVSS 8.8 rating and trivial Subscriber-level prerequisite - common on sites with open registration - make this a high-priority WordPress ecosystem flaw. Wordfence is the original reporter and primary intelligence source.
Authentication bypass in WP Captcha PRO (and the free Advanced Google reCAPTCHA plugin sharing the same slug) for WordPress versions through 5.38 allows authenticated Subscriber-level users to log in as any account, including Administrator. The flaw chains a missing capability check in the ajax_run_tool() AJAX handler with the create_temporary_link tool that issues passwordless login links for arbitrary users, enabling full account takeover. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Unauthenticated attackers can defeat the Google reCAPTCHA verification performed by the Advanced Google reCAPTCHA WordPress plugin (versions up to and including 5.40), allowing anti-bot/authentication checks on protected forms to be bypassed. The flaw is a CWE-288 authentication bypass using an alternate path or channel, rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), so no credentials, privileges, or user interaction are required and impact is limited to the integrity of the CAPTCHA control with no confidentiality or availability effect. Exploitation is constrained mainly by footprint - only WordPress sites running the vulnerable plugin version on a reachable form or authentication endpoint are affected - and no public exploit is identified at time of analysis.
Authentication-protection bypass in the WebFactory Login Lockdown WordPress plugin at version 2.17 and earlier lets unauthenticated remote attackers evade the plugin's failed-login lockout by spoofing the client identifier it relies on to count and block attempts, enabling sustained credential brute-force against wp-login.php. The assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, score 4.8) confirms that no authentication or user interaction is required, while the HIGH attack complexity reflects the need to reliably reproduce the spoofing condition; the impact is bounded to defeating the throttling control rather than directly granting access. The issue is mapped to CWE-290 and was reported by Patchstack; there is no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis.
CAPTCHA verification bypass in the WordPress plugin Captcha Code (by webfactory) version 3.32 and earlier allows unauthenticated remote attackers to submit protected forms without solving the challenge, weakening the anti-automation control on any form the plugin guards. The assessed CVSS v3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, base 4.8) confirms no authentication or user interaction is required, but its high attack complexity indicates the bypass is not guaranteed on every attempt and the outcome is confined to defeating the CAPTCHA itself - it does not yield WordPress account access or site compromise. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is a genuinely low-priority issue despite the 'authentication bypass' framing; its real-world value depends entirely on how sensitive the forms the CAPTCHA was protecting happen to be.
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.