CVE-2024-12034 describes a vulnerability in the webfactory Advanced Google reCAPTCHA WordPress plugin (versions up to 1.25) where the plugin does not use a strong unique key in generating unblock requests. This flaw enables unauthenticated attackers to unblock their IP addresses after being locked out due to too many failed password attempts, effectively bypassing the intended security control. The issue is categorized under CWE-340 (Generation of Predictable Numbers or Identifiers).

An attacker can circumvent the IP lockout mechanism designed to prevent brute force password attempts by exploiting predictable unblock request identifiers. This could lead to repeated unauthorized login attempts from the same IP address, potentially increasing the risk of password guessing attacks. There is no direct confidentiality or availability impact reported, and no known exploits in the wild have been identified.

Patch status is not yet confirmed — no official fix or patch links are currently available. Users should monitor the vendor's advisory for updates and apply any official patches once released. Until a fix is available, consider implementing additional protective measures such as external rate limiting or multi-factor authentication to mitigate brute force risks.