CVE-2022-2913

Login No Captcha reCAPTCHA < 1.7 - IP Check Bypass

The Login No Captcha reCAPTCHA WordPress plugin before 1.7 doesn't check the proper IP address allowing attackers to spoof IP addresses on the allow list and bypass the need for captcha on the login screen.

Affected

Login No Captcha reCAPTCHA

CVSS v3.1 NVD

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

EPSS

0.76% chance of exploitation in the next 30 days, 54th percentile

Published

2022-09-16

Updated

2025-06-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/5231ac18-ea9a-4bb9-af9f-e3d95a3b54f1

References

• CVE Record
• NVD entry