CVE-2025-24628: Google Captcha Auth Bypass Vulnerability

CVE-2025-24628 Overview

CVE-2025-24628 is an Authentication Bypass by Spoofing vulnerability in the BestWebSoft Google Captcha (reCAPTCHA) plugin for WordPress. The flaw affects all versions up to and including 1.78. Attackers can bypass the CAPTCHA verification step on protected forms, enabling identity spoofing and automated abuse of authentication and submission endpoints. The vulnerability is classified under [CWE-290: Authentication Bypass by Spoofing] and stems from insufficient validation of CAPTCHA responses. Because the plugin is commonly deployed on login, registration, and comment forms, exploitation weakens brute-force and bot protections that site owners rely on.

Critical Impact
Remote attackers can bypass CAPTCHA verification without authentication, enabling automated brute-force, credential stuffing, and spam submissions against protected WordPress forms.

Affected Products

BestWebSoft Google Captcha (reCAPTCHA) WordPress plugin
All versions from n/a through <= 1.78
WordPress sites relying on this plugin to protect login, registration, or comment forms

Discovery Timeline

2025-01-27 - CVE-2025-24628 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24628

Vulnerability Analysis

The vulnerability allows an unauthenticated attacker to bypass the CAPTCHA challenge enforced by the plugin. The plugin fails to correctly validate the authenticity of the CAPTCHA response submitted with a form request. As a result, an attacker can spoof a successful CAPTCHA verification and proceed as if a legitimate human interaction occurred.

According to the EPSS model, the probability of exploitation activity in the wild is 0.332% (percentile 25.4). While the numeric likelihood is modest, WordPress plugin flaws that weaken bot protection are frequently incorporated into automated attack toolkits.

Root Cause

The root cause is improper verification of the CAPTCHA token during form submission. The plugin does not sufficiently validate that the response returned by the client was produced by a legitimate CAPTCHA challenge tied to the current session. This design gap falls squarely under CWE-290, where an actor can spoof the identity of a validated CAPTCHA solver.

Attack Vector

Exploitation occurs over the network without authentication or user interaction. An attacker crafts HTTP POST requests to a form endpoint protected by the plugin, omitting or forging the fields the plugin uses to determine CAPTCHA success. The server-side logic accepts the request as if the CAPTCHA had been solved. Attackers can then run high-volume credential stuffing, comment spam, or registration abuse against the target site. See the Patchstack Vulnerability Report for the specific request pattern.

Detection Methods for CVE-2025-24628

Indicators of Compromise

Bursts of POST requests to wp-login.php, wp-comments-post.php, or registration endpoints without preceding requests to Google reCAPTCHA domains such as www.google.com/recaptcha/.
Successful form submissions missing or containing malformed g-recaptcha-response parameters.
Spike in failed login attempts or new user registrations from a small set of source IPs.
Unusual comment or contact form submission volume originating from non-browser user agents.

Detection Strategies

Correlate web server access logs to identify form submissions that lack a valid CAPTCHA challenge fetch immediately prior.
Deploy WAF rules that require the presence and server-side validation of a g-recaptcha-response token for protected endpoints.
Monitor WordPress authentication logs for elevated failure rates against accounts protected by the plugin.

Monitoring Recommendations

Ingest WordPress and web server logs into a centralized analytics or SIEM platform and alert on anomalous form submission rates.
Track outbound calls from the WordPress server to siteverify endpoints and alert when form submissions occur without corresponding verification calls.
Baseline normal registration and login volume per site and alert on statistical deviations.

How to Mitigate CVE-2025-24628

Immediate Actions Required

Identify all WordPress sites running the BestWebSoft Google Captcha plugin at version 1.78 or earlier.
Update the plugin to the latest version once a patched release is available from the vendor.
Enforce additional brute-force protections such as rate limiting and account lockout on wp-login.php.
Enable multi-factor authentication for all administrative WordPress accounts to reduce impact of credential stuffing.

Patch Information

The vulnerability affects versions up to and including 1.78. Site administrators should upgrade to the fixed release published by BestWebSoft. Refer to the Patchstack Vulnerability Report for current patch status and version guidance.

Workarounds

Temporarily replace the vulnerable plugin with an alternative CAPTCHA solution that performs server-side verification of the g-recaptcha-response token against the Google siteverify API.
Deploy a WAF rule that blocks POST requests to authentication and comment endpoints when the CAPTCHA token is missing or fails an out-of-band verification.
Restrict access to wp-login.php and wp-admin by source IP where feasible, and enable fail2ban-style banning for repeated failures.

bash

# Example WAF rule concept: require g-recaptcha-response on login submissions
# ModSecurity pseudo-rule
SecRule REQUEST_URI "@streq /wp-login.php" "chain,phase:2,deny,status:403,id:1002401,msg:'Missing CAPTCHA token'"
  SecRule &ARGS:g-recaptcha-response "@eq 0"