CVE-2025-15005 CouchCMS reCAPTCHA config.example.php hard-coded key
Hard-coded reCAPTCHA keys in CouchCMS allow attackers to bypass CAPTCHA verification, potentially enabling automated abuse of forms.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-15005?
CVE-2025-15005 is a medium-severity vulnerability in CouchCMS, published on 22 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A security flaw has been discovered in CouchCMS up to 2.4. Affected is an unknown function of the file couch/config.example.php of the component reCAPTCHA Handler. The manipulation of the argument K_RECAPTCHA_SITE_KEY/K_RECAPTCHA_SECRET_KEY results in use of hard-coded cryptographic key . It is possible to launch the attack remotely. This attack is characterized by high complexity. The exploitability is told to be difficult. The exploit has been released to the public and may be used for attacks.
Which versions are affected by CVE-2025-15005?
It affects 1 product.
Products include Couchcms Couchcms.
How do I fix CVE-2025-15005?
No fix has been published for CVE-2025-15005 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-15005 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-15005 exists.
Other vulnerabilities in CouchCMS
Sources
Also known as GHSA-7v96-f75p-x544.