CVE-2025-1262

Advanced Google reCaptcha <= 1.27 - Built-in Math CAPTCHA Bypass

Published Feb 25, 2025 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Description

The Advanced Google reCaptcha plugin for WordPress is vulnerable to CAPTCHA Bypass in versions up to, and including, 1.27 . This makes it possible for unauthenticated attackers to bypass the Built-in Math Captcha Verification.

Analysis

Technical impact

The Advanced Google reCaptcha plugin for WordPress is vulnerable to a CAPTCHA bypass in its Built‑in Math Captcha verification. With this flaw, unauthenticated attackers can submit forms or perform automated actions without completing the mathematical challenge, potentially facilitating spam, credential stuffing, or brute‑force attempts. The weakness is a Classic Input Validation problem, classified as CWE‑804.

Affected Systems

The vulnerability affects the webfactory:Advanced Google reCAPTCHA WordPress plugin in all releases up to and including version 1.27. Users operating any of those releases are impacted.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The flaw is not listed in CISA’s KEV catalog. Exploitation requires only unauthenticated access to a site that uses the Math Captcha, making it a remote attack vector over HTTP/HTTPS. While immediate life‑threatening risk is low, attackers could use it to automate malicious submissions.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

webfactory

Advanced Google reCAPTCHA

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.27

Configuration 1 [-]

cpe:2.3:a:webfactoryltd:advanced_google_recaptcha:*:*:*:*:*:wordpress:*:*

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Advanced Google reCaptcha plugin to version 1.28 or later
If an upgrade is not possible, disable the Math Captcha feature or remove the plugin entirely
Implement web‑application firewall rules to detect and block known bypass patterns and monitor for abnormal form submission activity

Generated by OpenCVE AI on April 20, 2026 at 23:48 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-5445	The Advanced Google reCaptcha plugin for WordPress is vulnerable to CAPTCHA Bypass in versions up to, and including, 1.27 . This makes it possible for unauthenticated attackers to bypass the Built-in Math Captcha Verification.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.344% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://plugins.trac.wordpress.org/changeset/3244677/advanced-google-recaptcha
https://www.wordfence.com/threat-intel/vulnerabilities/id/d553aab2-d441-46d6-9c01-5dcfdc48674f?source=cve

History

Feb 28, 2025 2:00 AM First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Webfactoryltd Webfactoryltd advanced Google Recaptcha
Weaknesses		NVD-CWE-Other
CPEs		cpe:2.3:a:webfactoryltd:advanced_google_recaptcha::::::wordpress::*
Vendors & Products		Webfactoryltd Webfactoryltd advanced Google Recaptcha

Feb 25, 2025 3:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Feb 25, 2025 1:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The Advanced Google reCaptcha plugin for WordPress is vulnerable to CAPTCHA Bypass in versions up to, and including, 1.27 . This makes it possible for unauthenticated attackers to bypass the Built-in Math Captcha Verification.
Title		Advanced Google reCaptcha <= 1.27 - Built-in Math CAPTCHA Bypass
Weaknesses		CWE-804
References		https://plugins.trac.wordpress.org/changeset/3244677/advanced-google-recaptcha https://www.wordfence.com/threat-intel/vulnerabilities/id/d553aab2-d441-46d6-9c01-5dcfdc48674f?source=cve
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}`