The vulnerability identified as CVE-2025-24628 affects the bestwebsoft Google Captcha plugin (versions up to 1.78). It allows an attacker to bypass authentication by spoofing identity, which could compromise the intended security function of the captcha mechanism. The issue is categorized as an authentication bypass by spoofing vulnerability. No patch or remediation details are currently provided, and no CVSS score has been assigned.

An attacker exploiting this vulnerability could bypass authentication controls by spoofing identity, potentially gaining unauthorized access or bypassing security checks that rely on the Google Captcha plugin. This undermines the effectiveness of the captcha in preventing automated or unauthorized access. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates and consider additional authentication controls to mitigate risk.