Vulnerabilidades conocidas, compatibilidad con PHP y alternativas más seguras para el plugin de WordPress Advanced Google Recaptcha — verificado contra la base de datos de seguridad local de WP Clinic.
Qué hace este plugin
- Slug:
advanced-google-recaptcha
- 200000+ instalaciones activas
captchacomment reCAPTCHAgoogle recaptchalogin recaptcharecaptcha
Estado de mantenimiento
- Última versión conocida: 5.40
- Requiere PHP: 5.2+
- PHP máximo soportado (analizado): 8.4
Vulnerabilidades conocidas
5 CVEs conocidos registrados para Advanced Google Recaptcha.
| CVE |
Vulnerabilidad |
Tipo |
Gravedad |
Afectadas |
Corregido en |
Publicado |
Estado |
|
CVE-2026-5415
|
Advanced Google reCAPTCHA [advanced-google-recaptcha] < 5.39 |
Elusión de autenticación mediante una ruta o canal alternativo |
Alta
8,8
|
< 5.39
|
5.39 |
2026-06-05 |
✓ corregido en la última versión
|
|
CVE-2026-5411
|
Advanced Google reCAPTCHA [advanced-google-recaptcha] < 5.39 |
Carga de archivos sin restricción de tipo peligroso |
Alta
8,8
|
< 5.39
|
5.39 |
2026-06-05 |
✓ corregido en la última versión
|
|
CVE-2024-12034
|
Advanced Google reCAPTCHA [advanced-google-recaptcha] < 1.26 |
Generación de números o identificadores predecibles |
Media
5,3
|
< 1.26
|
1.26 |
2024-12-23 |
✓ corregido en la última versión
|
|
CVE-2025-1262
|
Advanced Google reCAPTCHA [advanced-google-recaptcha] < 1.28 |
CAPTCHA adivinable |
Media
5,3
|
< 1.28
|
1.28 |
0000-00-00 |
✓ corregido en la última versión
|
|
CVE-2025-2074
|
Advanced Google reCAPTCHA [advanced-google-recaptcha] < 1.30 |
Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL) |
Media
5,3
|
< 1.30
|
1.30 |
0000-00-00 |
✓ corregido en la última versión
|
CVE-2026-5415
The WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug) plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.38. This is due to the ajax_run_tool() AJAX handler relying solely on a nonce check (check_ajax_referer) for security without performing any capability check, combined with the create_temporary_link tool allowing the generation of passwordless login links for arbitrary users, and the handle_temporary_links() function authenticating visitors via these links without any additional authorization validation. The required nonce is exposed to all authenticated backend users (including Subscribers) via wp_localize_script() on all non-settings admin pages when the plugin's welcome pointer has not been dismissed. This makes it possible for authenticated attackers, with Subscriber-level access and above, to bypass normal authentication and log in as any user, including Administrators, resulting in complete account takeover.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2026-5411
The WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug) plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 5.38. This is due to a capability check in the save_ajax() function of the licensing module, combined with unrestricted file extraction in sync_cloud_protection(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files including PHP webshells to the server by injecting a malicious cloud_protection_url into the license meta, which the plugin then downloads and extracts without file type validation into a web-accessible uploads directory. This can be used for remote code execution. Note: The vulnerability can only be exploited with a remote URL if "allow_url_fopen" is enabled in the php.ini config.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2024-12034
The Advanced Google reCAPTCHA plugin for WordPress is vulnerable to IP unblocking in all versions up to, and including, 1.25. This is due to the plugin not utilizing a strong unique key when generating an unblock request. This makes it possible for unauthenticated attackers to unblock their IP after being locked out due to too many bad password attempts
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2025-1262
The Advanced Google reCaptcha plugin for WordPress is vulnerable to CAPTCHA Bypass in versions up to, and including, 1.27 . This makes it possible for unauthenticated attackers to bypass the Built-in Math Captcha Verification.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2025-2074
The Advanced Google reCAPTCHA plugin for WordPress is vulnerable to generic SQL Injection via the ‘sSearch’ parameter in all versions up to, and including, 1.29 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries, particularly when the plugin’s settings page hasn’t been visited and its welcome message has not been dismissed. This issue can be used to extract sensitive information from the database.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
Cómo solucionarlo
Mantén Advanced Google Recaptcha actualizado — 5.40 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").
Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.
Alternativas más seguras / más establecidas