CVE-2024-12034: WordPress reCAPTCHA Auth Bypass Vulnerability

CVE-2024-12034 Overview

The Advanced Google reCAPTCHA plugin for WordPress contains an IP unblocking vulnerability affecting all versions up to and including 1.25. The plugin generates unblock request tokens without using a strong unique key, allowing unauthenticated attackers to bypass the IP lockout mechanism. Attackers who trigger a lockout from failed password attempts can craft an unblock request and regain access to continue brute-force attacks against WordPress login endpoints. The weakness is tracked under CWE-340: Generation of Predictable Numbers or Identifiers.

Critical Impact

Unauthenticated attackers can self-unblock their IP address after triggering lockouts, defeating the plugin's brute-force protection and enabling sustained credential-guessing attacks against WordPress authentication.

Affected Products

• Advanced Google reCAPTCHA plugin for WordPress — all versions through 1.25
• WordPress sites relying on this plugin for brute-force login protection
• Administrator and user login endpoints protected by the plugin's IP blocklist

Discovery Timeline

• 2024-12-24 - CVE-2024-12034 published to the National Vulnerability Database
• 2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-12034

Vulnerability Analysis

The Advanced Google reCAPTCHA plugin blocks IP addresses after repeated failed login attempts. Blocked users receive an unblock link that references a token generated by the plugin. The token derivation does not incorporate a strong unique key, so an attacker can predict or forge valid unblock requests without any authentication.

An attacker triggers the lockout by submitting invalid credentials against wp-login.php. The plugin then stores the attacker's IP in its blocklist and generates an unblock URL. Because the identifier is predictable, the attacker constructs a matching unblock request, submits it from the same IP, and clears the block entry. The attacker then resumes credential guessing, repeating the cycle indefinitely.

This vulnerability neutralizes the plugin's primary brute-force defense. It does not grant direct code execution or data disclosure, but it enables credential compromise on sites with weak or reused passwords.

Root Cause

The root cause is insufficient entropy and lack of a server-side secret in the unblock token generation routine. Weak identifier generation falls under CWE-340. A secure implementation would bind the unblock token to a cryptographically random value stored server-side and validate it with constant-time comparison.

Attack Vector

Exploitation is remote, unauthenticated, and requires no user interaction. The attacker interacts only with public WordPress login endpoints and the plugin's unblock handler. Refer to the Wordfence Vulnerability Report and the WordPress Changeset Update for technical specifics on the fix.

Detection Methods for CVE-2024-12034

Indicators of Compromise

• Repeated failed authentication attempts against wp-login.php from the same source IP, followed by renewed login attempts shortly after a lockout window.
• HTTP requests to the plugin's unblock endpoint originating from IPs that were recently added to the blocklist.
• WordPress audit logs showing blocklist entries removed without administrator action.
• Successful logins on accounts preceded by hundreds of failed attempts from the same IP or IP range.

Detection Strategies

• Correlate failed login events with subsequent unblock requests from the same source address in the same session window.
• Alert when a single IP generates a lockout and completes an unblock within short time intervals, especially repeatedly.
• Monitor plugin logs for unblock requests that lack an authenticated administrator session.

Monitoring Recommendations

• Centralize WordPress authentication and plugin logs for correlation across attempts, lockouts, and unblocks.
• Track the ratio of lockout events to unblock events per IP; a value approaching 1:1 indicates abuse.
• Monitor for distributed brute-force patterns where many IPs each trigger a single lockout-unblock cycle.

How to Mitigate CVE-2024-12034

Immediate Actions Required

• Update the Advanced Google reCAPTCHA plugin to the version published after changeset 3208704 on WordPress.org.
• Audit WordPress administrator and editor accounts for weak passwords and enforce reset where appropriate.
• Enable multi-factor authentication on all privileged WordPress accounts to limit the impact of credential guessing.
• Review recent login logs for successful authentications preceded by sustained failed attempts.

Patch Information

The maintainer addressed the issue in a version released after the WordPress Changeset Update. The fix introduces a stronger unique key in the unblock token generation. Site administrators should upgrade to the latest version available through the WordPress plugin repository.

Workarounds

• Place the WordPress login endpoint behind a web application firewall (WAF) rule that rate-limits authentication attempts per IP.
• Restrict access to wp-login.php and wp-admin by source IP where feasible, using server-level allowlists.
• Disable the vulnerable plugin and rely on an alternative brute-force protection mechanism until the patched version is deployed.
• Shorten the maximum session lifetime and require re-authentication for sensitive administrative actions.

# Configuration example: nginx rate-limit for wp-login.php
limit_req_zone $binary_remote_addr zone=wplogin:10m rate=5r/m;

location = /wp-login.php {
    limit_req zone=wplogin burst=3 nodelay;
    limit_req_status 429;
}