{
 "id": "WPSEC-2026-2837",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2837/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2837/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2837/index.md",
 "title": "reCAPTCHA for WooCommerce <= 1.4.7 - Unauthenticated CAPTCHA Bypass via WordPress Login and Lost Password Forms",
 "description": "The reCAPTCHA for WooCommerce plugin for WordPress is vulnerable to a CAPTCHA bypass via the WordPress login and lost password forms in all versions up to, and including, 1.4.7. This is due to the plugin deciding whether the request is for wp-login.php with a loose substring match on the raw request URI, which an encoded path such as /wp-login.ph%70 does not match even though wp-login.php still runs. In addition, the login check is skipped whenever a valid WooCommerce login nonce is posted, and that nonce is shown to every visitor on the public My Account page. This makes it possible for unauthenticated attackers to send login attempts and password reset requests to wp-login.php without solving the reCAPTCHA. This defeats the brute-force and abuse protection the site owner turned on.",
 "plugin": {
  "slug": "recaptcha-woo",
  "name": "reCAPTCHA for WooCommerce",
  "full_name": "reCAPTCHA for WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/recaptcha-woo/",
  "advisories_url": "https://wpsec.com/vuln/plugin/recaptcha-woo/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/recaptcha-woo"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-693"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "1.2.9",
    "from_inclusive": true,
    "to": "1.5.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 1.2.9 before 1.5.0"
  ]
 },
 "introduced_in": "1.2.9",
 "fixed_in": "1.5.0",
 "remediation": "Update to 1.5.0 or later.",
 "fix_released": "2026-11-09T22:06:15+00:00",
 "published": "2026-11-10T22:42:54+00:00",
 "updated": "2026-11-10T00:16:08.047387+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2837/",
  "https://plugins.svn.wordpress.org/recaptcha-woo/tags/1.5.0/",
  "https://wordpress.org/plugins/recaptcha-woo/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/recaptcha-woo",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-10"
 }
}