CVE-2024-12034 Advanced Google reCAPTCHA <= 1.25 - Brute Force Protection IP Unblock
Unauthenticated attackers can bypass IP blocking protections in the Advanced Google reCAPTCHA WordPress plugin by exploiting weak unblock request keys.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-12034?
CVE-2024-12034 is a medium-severity vulnerability in webfactory Advanced Google reCAPTCHA, published on 24 Dec 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Advanced Google reCAPTCHA plugin for WordPress is vulnerable to IP unblocking in all versions up to, and including, 1.25. This is due to the plugin not utilizing a strong unique key when generating an unblock request. This makes it possible for unauthenticated attackers to unblock their IP after being locked out due to too many bad password attempts
Weakness: CWE-340
Which versions are affected by CVE-2024-12034?
How do I fix CVE-2024-12034?
No fix has been published for CVE-2024-12034 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-12034 being exploited?
There is no known exploitation of CVE-2024-12034 in the wild and no public exploit code.
Sources
Also known as GHSA-m8p9-q5r3-wrmf.