CVE-2025-2074: WordPress reCAPTCHA Plugin SQLI Vulnerability

CVE-2025-2074 Overview

CVE-2025-2074 is a SQL injection vulnerability in the Advanced Google reCAPTCHA plugin for WordPress. The flaw affects all plugin versions up to and including 1.29. The vulnerability stems from insufficient escaping of the sSearch parameter and inadequate preparation of the underlying SQL query. Authenticated attackers with Subscriber-level access or above can append arbitrary SQL statements to existing queries. Exploitation requires that the plugin's settings page has not been visited and its welcome message remains dismissed, making this a conditional attack path. Successful exploitation allows extraction of sensitive information from the WordPress database, including user credentials and application secrets.

Critical Impact
Authenticated Subscriber-level users can extract sensitive database contents through crafted sSearch parameter payloads under specific plugin state conditions.

Affected Products

Advanced Google reCAPTCHA plugin for WordPress, versions 1.0 through 1.29
WordPress sites using the plugin where the welcome message has not been dismissed
Sites with any authenticated account at Subscriber role or higher

Discovery Timeline

2025-03-28 - CVE-2025-2074 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2074

Vulnerability Analysis

The vulnerability is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command. The plugin exposes AJAX endpoints that accept a sSearch parameter used for server-side data table filtering. The developer concatenated the user-supplied search string directly into a SQL query without applying $wpdb->prepare() or sanitizing the input with esc_sql(). This creates a generic SQL injection sink reachable by any authenticated user meeting the plugin state precondition.

Exploitation requires network access to WordPress AJAX handlers, low authentication privileges, and the specific application state where the plugin welcome notice has not been dismissed. The attack complexity is elevated because the vulnerable code path is only reachable under that condition.

Root Cause

The root cause is direct interpolation of the raw sSearch HTTP parameter into a SQL statement inside the plugin's AJAX handlers. Review of the plugin source in libs/ajax.php at lines 20, 277, and 401, along with libs/admin.php line 106 and libs/setup.php line 636, shows that WordPress database abstraction layer safeguards were not applied consistently. Without $wpdb->prepare() placeholders or explicit escaping, the query loses its trust boundary between structure and data.

Attack Vector

An attacker with Subscriber-level credentials sends an authenticated HTTP request to the plugin's AJAX endpoint. The request supplies a crafted sSearch value containing SQL syntax such as UNION SELECT clauses or subqueries targeting the wp_users or wp_usermeta tables. Because the query is not parameterized, the injected fragment executes as part of the original statement. The attacker can then exfiltrate password hashes, session tokens, API keys stored in options, or arbitrary content from any table accessible to the WordPress database user. See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-2074

Indicators of Compromise

HTTP POST requests to wp-admin/admin-ajax.php containing sSearch parameter values with SQL keywords such as UNION, SELECT, SLEEP, or comment markers like -- and #
Unexpected authenticated AJAX activity originating from Subscriber-level accounts
Database error entries in debug.log referencing malformed queries from the advanced-google-recaptcha plugin
Presence of the plugin welcome notice option in wp_options indicating the unpatched precondition state

Detection Strategies

Deploy a web application firewall rule that inspects the sSearch parameter for SQL metacharacters and reserved words on admin-ajax endpoints
Enable WordPress query logging and alert on queries containing concatenated user input targeting the plugin's tables
Correlate authentication logs with AJAX request patterns to identify low-privilege accounts issuing atypical search payloads

Monitoring Recommendations

Monitor authenticated request rates against admin-ajax.php for anomalous spikes tied to individual Subscriber accounts
Alert on outbound database result sizes that exceed baselines for reCAPTCHA-related actions
Track new account registrations followed by immediate AJAX activity, a common pre-exploitation pattern

How to Mitigate CVE-2025-2074

Immediate Actions Required

Update the Advanced Google reCAPTCHA plugin to a version above 1.29 that includes the fix from Changeset #3262396
Visit the plugin settings page and dismiss the welcome notice to remove the vulnerable code path on unpatched installations
Audit existing WordPress user accounts and remove unused Subscriber-level registrations
Rotate WordPress secret keys and administrator credentials if exploitation is suspected

Patch Information

The vendor addressed the vulnerability in the plugin update tracked by Changeset #3262396. The fix introduces proper parameterization of the sSearch value using the WordPress $wpdb->prepare() API. Administrators should verify the installed plugin version through the WordPress admin dashboard after applying the update. Consult the WordPress Developer Resources for release notes.

Workarounds

Disable open user registration in WordPress General Settings to prevent attackers from acquiring Subscriber accounts
Restrict access to wp-admin/admin-ajax.php through IP allowlists where operationally feasible
Deploy WAF signatures that block SQL injection payloads in the sSearch parameter until patching is complete
Temporarily deactivate the Advanced Google reCAPTCHA plugin on sites where an immediate update cannot be applied

bash

# Configuration example: WP-CLI commands to update the plugin and audit users
wp plugin update advanced-google-recaptcha
wp plugin get advanced-google-recaptcha --field=version
wp user list --role=subscriber --fields=ID,user_login,user_registered
wp option get widget_advanced-google-recaptcha_welcome