WordPress Plugin Vulnerabilities
Login No Captcha reCAPTCHA < 1.7 - IP Check Bypass
Description
The plugin doesn't check the proper IP address allowing attackers to spoof IP addresses on the allow list and bypass the need for captcha on the login screen.
Proof of Concept
Set HTTP_CLIENT_IP, HTTP_X_FORWARDED_FOR or any other header in LoginNoCaptcha::get_ip_address() which is then checked against the whitelist and Google reCaptcha. The only caveat on this PoC is that attacker must know the list of IP addresses added to the allow list. This can be done by luring administrators to fake pages, but increases the complexity of the attack.
Affects Plugins
Fixed in 1.7 References
CVE
Miscellaneous
Original Researcher
Daniel Ruf
Submitter
Daniel Ruf
Submitter website
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2022-08-22 (about 1 years ago)
Added
2022-08-22 (about 1 years ago)
Last Updated
2023-05-11 (about 6 months ago)
WPScan 