Medium severity · published Dec 24, 2024
CVE-2024-12034
Advanced Google reCAPTCHA <= 1.25 - Brute Force Protection IP Unblock
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
The Advanced Google reCAPTCHA plugin for WordPress is vulnerable to IP unblocking in all versions up to, and including, 1.25. This is due to the plugin not utilizing a strong unique key when generating an unblock request. This makes it possible for unauthenticated attackers to unblock their IP after being locked out due to too many bad password attempts
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AG
Advanced Google reCAPTCHA · webfactory
through 1.25 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-12034
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-12034
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3208704%40advanced-google-recaptcha&new=3208704%40advanced-google-recaptcha&sfp_email=&sfph_mail=
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/0fa7e6f6-92b2-494b-8c7a-76ba8213b610?source=cve
More from Advanced Google reCAPTCHA
8.8
CVE-2026-5411
WP Captcha PRO <= 5.38 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload
8.8
CVE-2026-5415
WP Captcha PRO <= 5.38 - Authenticated (Subscriber+) Authentication Bypass via Temporary Login Link
5.3
CVE-2026-100518
WordPress Advanced Google reCAPTCHA plugin <= 5.40 - Broken Authentication vulnerability