The reCAPTCHA for all plugin, versions up to 2.22, contains a Cross‑Site Request Forgery flaw (CWE‑352) that allows an attacker to forge requests on behalf of an authenticated user, potentially causing unintended actions on the site. The vulnerability is not a remote code execution but can lead to unauthorized data modification or settings changes if the victim is logged into WordPress. Its CVSS score of 4.3 indicates moderate severity.

The affected product is the WordPress plugin reCAPTCHA for all developed by sminozzi. It impacts all installations of the plugin with versions from the earliest release up to and including 2.22. No other vendor or product is listed.

The exploit probability is very low, as the EPSS score is less than 1 %. It is not listed in the CISA KEV catalog. Attackers could craft malicious URLs or embedded forms to trigger the CSRF action against users who are currently authenticated. The low EPSS suggests that large‑scale exploitation is unlikely, but the presence of the flaw still poses a moderate risk to any site using the vulnerable plugin version.