blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2022-2913

MEDIUM 4.3 CVSS 3.1
Published
September 16, 2022
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
Weakness
CWE-639
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Description

The Login No Captcha reCAPTCHA WordPress plugin before 1.7 doesn't check the proper IP address allowing attackers to spoof IP addresses on the allow list and bypass the need for captcha on the login screen.

Affected WordPress components

  • Login No Captcha reCAPTCHA Plugin · login-recaptcha
    Confirmed match Active
    From 1.7 (including) to 1.7 (excluding)
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Unknown Login No Captcha reCAPTCHA — From 1.7 (including) to 1.7 (excluding)
  • login_no_captcha_recaptcha_project login_no_captcha_recaptcha — Before 1.7

References

  • wpscan.com https://wpscan.com/vulnerability/5231ac18-ea9a-4bb9-af9f-e3d95a3b54f1 Exploit, Patch, Third Party Advisory
  • nvd.nist.gov Official NVD record