PT-2011-2614 · WordPress · Wp-Recaptcha

Published 2011-03-22 · Updated 2017-08-17 · CVE-2011-0759

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WP-reCAPTCHA plugin version 2.9.8.2

Description The issue concerns multiple cross-site request forgery (CSRF) vulnerabilities in the configuration page of the WP-reCAPTCHA plugin for WordPress. These vulnerabilities allow remote attackers to hijack the authentication of administrators for requests, potentially leading to the disabling of the CAPTCHA requirement or the insertion of cross-site scripting (XSS) sequences. The vulnerable parameters include recaptcha opt pubkey, recaptcha opt privkey, re tabindex, error blank, error incorrect, mailhide pub, mailhide priv, mh replace link, and mh replace title.

Recommendations For WP-reCAPTCHA plugin version 2.9.8.2, consider disabling the configuration page or restricting access to it until a patch is available. Avoid using the vulnerable parameters in the configuration page to minimize the risk of exploitation. As a temporary workaround, restrict the ability to disable the CAPTCHA requirement or insert XSS sequences via the configuration page. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2011-0759

Affected Products

Wp-Recaptcha

References · 7

• http://secunia.com/advisories/43771 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-0759 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/66167 · Note
• http://archives.neohapsis.com/archives/fulldisclosure/2011-03/0206.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0759 · Note
• http://securityfocus.com/bid/46909 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/66169 · Note