The Advanced Google reCAPTCHA plugin for WordPress is vulnerable to a generic SQL Injection via the sSearch parameter in all releases up to and including 1.29. Inadequate escaping and lack of query preparation allow an attacker who possesses Subscriber level or higher privileges to append additional SQL statements to existing queries, potentially exposing sensitive database information. This weakness is classified as CWE‑89.

All versions of the Advanced Google reCAPTCHA plugin (webfactory) running on WordPress, specifically releases 1.0 through 1.29, are affected. The vulnerability exists regardless of whether the plugin’s settings page has been visited or its welcome message dismissed.

The CVSS score is 5.3, indicating moderate severity. The EPSS score is less than 1%, showing the likelihood of exploitation is low but non‑zero, and the vulnerability is not listed in the CISA KEV catalog. Attackers must first authenticate to WordPress with Subscriber or higher permissions; from there, they can use the sSearch parameter in the plugin’s AJAX endpoints to inject SQL. The attack vector is therefore an authenticated web application exploitation, likely triggered from the admin interface or plugin configuration pages.