This vulnerability is an unauthenticated broken authentication flaw (CWE-288) in the WordPress Advanced Google reCAPTCHA plugin up through version 5.40. A malicious actor can gain unauthorized access to the plugin’s administrative interface without needing valid credentials, potentially allowing manipulation of the plugin’s configuration or other actions within the site’s WordPress administration.

The affected product is the WordPress Advanced Google reCAPTCHA plugin developed by WebFactory. Versions 5.40 and earlier are affected. The flaw exists on WordPress sites that have any of those plugin versions installed.

The CVSS score of 5.3 indicates moderate severity. The EPSS score of <1% shows a very low probability that this vulnerability has been exploited in the wild, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated request to the plugin’s exposed endpoints, an inference based on the description of "Unauthenticated Broken Authentication."