Plugins · advanced-google-recaptcha · data as of 2026-11-04
Is Advanced Google reCAPTCHA safe? Known vulnerabilities and latest version
- Latest version
- 5.42
- Last updated
- 2026-10-06
- Active installs
- 200,000+
- Known issues on record
- 6
- Unpatched in latest
- 0
- Tested up to WP
- 7.1.4 · PHP 5.2+
Captcha protection against spam comments & brute force login attacks using Google reCAPTCHA. — by WebFactory
What to do
- Update to the latest version (5.42). Anything older than 5.41 has at least one known issue listed below. Dashboard → Updates, or Plugins → “update now”.
- If you cannot update right away, deactivate it until you can.
- Turn on auto-updates for it: Plugins → “Enable auto-updates” on its row.
- If you ran a vulnerable version and something looks off (spam pages, strange admins, redirects), run the free scan.
With WP-CLI: wp plugin get advanced-google-recaptcha --field=version shows what you run; wp plugin update advanced-google-recaptcha updates it.
Check your version
Known vulnerabilities
6 on record, newest first. “Affected” is the version range the source gives; “fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version.
medium 5.3 CVE-2026-100518 · published 2026-10-06
Authentication bypass in Advanced Google reCAPTCHA (5.40 and older)
- Affected
- 5.40 and older
- Fixed in
- 5.41
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by Patchstack
Details from the advisory
Unauthenticated Broken Authentication in Advanced Google reCAPTCHA <= 5.40 versions.
high 8.8 CVE-2026-5415 · published 2026-06-05
Authentication bypass in Advanced Google reCAPTCHA (5.38 and older)
- Affected
- 5.38 and older
- Fixed in
- 5.39 *
- Access needed (per CVSS)
- Needs a low-level account (e.g. subscriber)
- Range from
- CVE record (the advisory publisher) · score by Wordfence
Details from the advisory
The WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug) plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.38. This is due to the ajax_run_tool() AJAX handler relying solely on a nonce check (check_ajax_referer) for security without performing any capability check, combined with the create_temporary_link tool allowing the generation of passwordless login links for arbitrary users, and the handle_temporary_links() function authenticating visitors via these links without any additional authorization validation. The required nonce is exposed to all authenticated backend users (including Subscribers) via wp_localize_script() on all non-settings admin pages when the plugin's welcome pointer has not been dismissed. This makes it possible for authenticated attackers, with Subscriber-level access and above, to bypass normal authentication and log in as any user, including Administrators, resulting in complete account takeover.
high 8.8 CVE-2026-5411 · published 2026-06-05
Arbitrary file upload in Advanced Google reCAPTCHA (5.38 and older)
- Affected
- 5.38 and older
- Fixed in
- 5.39 *
- Access needed (per CVSS)
- Needs a low-level account (e.g. subscriber)
- Range from
- CVE record (the advisory publisher) · score by Wordfence
Details from the advisory
The WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug) plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 5.38. This is due to a capability check in the save_ajax() function of the licensing module, combined with unrestricted file extraction in sync_cloud_protection(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files including PHP webshells to the server by injecting a malicious cloud_protection_url into the license meta, which the plugin then downloads and extracts without file type validation into a web-accessible uploads directory. This can be used for remote code execution. Note: The vulnerability can only be exploited with a remote URL if "allow_url_fopen" is enabled in the php.ini config.
medium 5.3 CVE-2025-2074 · published 2025-03-28
SQL injection in Advanced Google reCAPTCHA (1.29 and older)
- Affected
- 1.29 and older
- Fixed in
- 1.30 *
- Access needed (per CVSS)
- Needs a low-level account (e.g. subscriber)
- Range from
- CVE record (the advisory publisher) · score by Wordfence
Details from the advisory
The Advanced Google reCAPTCHA plugin for WordPress is vulnerable to generic SQL Injection via the ‘sSearch’ parameter in all versions up to, and including, 1.29 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries, particularly when the plugin’s settings page hasn’t been visited and its welcome message has not been dismissed. This issue can be used to extract sensitive information from the database.
NVD CVE-2025-2074Wordfence advisoryCode change (fix)wordpress.orgPlugin source
medium 5.3 CVE-2025-1262 · published 2025-02-25
Security issue in Advanced Google reCAPTCHA (1.27 and older)
- Affected
- 1.27 and older
- Fixed in
- 1.28 *
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by Wordfence
Details from the advisory
The Advanced Google reCaptcha plugin for WordPress is vulnerable to CAPTCHA Bypass in versions up to, and including, 1.27 . This makes it possible for unauthenticated attackers to bypass the Built-in Math Captcha Verification.
medium 5.3 CVE-2024-12034 · published 2024-12-24
Security issue in Advanced Google reCAPTCHA (1.25 and older)
- Affected
- 1.25 and older
- Fixed in
- 1.26 *
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by Wordfence
Details from the advisory
The Advanced Google reCAPTCHA plugin for WordPress is vulnerable to IP unblocking in all versions up to, and including, 1.25. This is due to the plugin not utilizing a strong unique key when generating an unblock request. This makes it possible for unauthenticated attackers to unblock their IP after being locked out due to too many bad password attempts
Recent activity
- 2026-10-06 — latest release on wordpress.org (5.42).
- 2026-10-06 — Authentication bypass disclosed (CVE-2026-100518), fixed in 5.41.
- 2026-06-05 — Authentication bypass disclosed (CVE-2026-5415), fixed in 5.39.
- 2026-06-05 — Arbitrary file upload disclosed (CVE-2026-5411), fixed in 5.39.
Get an email when Advanced Google reCAPTCHA has a new vulnerability
Free. We check the CVE feeds every day and email you only when a new issue for Advanced Google reCAPTCHA (advanced-google-recaptcha) is published or a fix ships. Unsubscribe in one click.
Browse vulnerabilities
- Published this week
- Unpatched in the latest version
- By type of vulnerability
- Plugins by WebFactory (8 tracked)
Types found in this plugin: Authentication bypass (2) · Arbitrary file upload (1) · SQL injection (1)
Where this data comes from
- Version, last update, installs: wordpress.org/plugins/advanced-google-recaptcha (Plugins API), fetched 2026-11-04.
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Each record links to its CVE page and to the original advisory (Wordfence, Patchstack or WPScan) where there is one. We only list a CVE here when its references or its advisory name this exact plugin, so a few real issues may be missing; none should be about a different plugin. Spot an error? Email Daniel.
Badge for your site or docs (states facts with a date, not a verdict):
<a href="https://laskyr.com/plugins/advanced-google-recaptcha"><img src="https://laskyr.com/plugins/advanced-google-recaptcha/badge.svg" alt="Advanced Google reCAPTCHA vulnerability status"></a>