The Brian S. Reed Contact Form 7 reCAPTCHA plugin versions up to 1.2.0 contain a CSRF vulnerability (CVE-2025-23972). This vulnerability enables attackers to trick authenticated users into submitting unwanted requests to the application, potentially leading to unauthorized actions. The CVSS 3.1 vector indicates the attack can be performed remotely with low complexity and requires user interaction but no privileges. Confidentiality and availability impacts are not present, but integrity impact is low.

The vulnerability allows an attacker to induce a user to perform unintended actions on the Contact Form 7 reCAPTCHA plugin, potentially altering plugin behavior or settings without the user's consent. The impact is limited to low integrity compromise and does not affect confidentiality or availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor for updates from Brian S. Reed or the plugin maintainers. Until a fix is available, consider implementing CSRF protections at the application or server level if possible.