The Giveaways and Contests by RafflePress plugin fails to remove the reCAPTCHA secret key from giveaway settings, embedding it in public giveaway pages. This flaw, identified as a CWE‑200 issue, permits unauthenticated visitors to retrieve the secret key for any active giveaway that has reCAPTCHA enabled, exposing sensitive credentials that should remain confidential.

WordPress sites that have the Giveaways and Contests by RafflePress plugin with a version earlier than 1.12.27 and that enable reCAPTCHA on any active giveaway. No specific WordPress core or PHP version constraints are documented, so the risk applies to any standard WordPress installation hosting the vulnerable plugin.

Exploitation requires no authentication and can be performed simply by visiting a publicly accessible giveaway page containing reCAPTCHA. The CVSS score of 5.3 indicates moderate severity, but the ease of access and lack of defensive barriers make the risk significant. The EPSS score of < 1 % reflects a low current exploitation probability, and the vulnerability is not yet in the CISA KEV catalog. Nevertheless, an attacker who obtains the secret key could abuse it for automated captcha solving or other malicious API interactions.