CVE-2024-12034
Advanced Google reCAPTCHA <= 1.25 - Brute Force Protection IP Unblock
- State
- Published
- Severity
- 5.3 Medium
- Published
- Dec 24, 2024
- Updated
- Apr 8, 2026
- Reserved
- Dec 2, 2024
Description
The Advanced Google reCAPTCHA plugin for WordPress is vulnerable to IP unblocking in all versions up to, and including, 1.25. This is due to the plugin not utilizing a strong unique key when generating an unblock request. This makes it possible for unauthenticated attackers to unblock their IP after being locked out due to too many bad password attempts
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N | Wordfence |
Weaknesses
- CWE-340 Generation of Predictable Numbers or Identifiers
Affected Products
| Product | Versions |
|---|---|
Advanced Google reCAPTCHAwebfactory |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.