The Advanced Google reCAPTCHA plugin for WordPress (webfactory) versions up to 1.27 contains a CWE-804 vulnerability where the built-in math CAPTCHA verification can be bypassed by unauthenticated attackers. This is due to guessable CAPTCHA challenges that fail to provide effective bot mitigation. The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. No known exploits are reported in the wild, and no patch or official fix information is currently available.

An attacker can bypass the CAPTCHA protection mechanism, potentially allowing automated or scripted interactions that the CAPTCHA was designed to block. This could lead to integrity issues such as spam or abuse of forms protected by the vulnerable CAPTCHA. There is no direct impact on confidentiality or availability according to the CVSS vector and description.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling the vulnerable CAPTCHA feature or replacing it with a more secure CAPTCHA solution to prevent bypass. Monitor vendor channels for updates or official patches addressing this vulnerability.