What’s Vulnerable › Vulnerabilities

CVE-2022-2913: Login No Captcha reCAPTCHA < 1.7 - IP Check Bypass

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-09-16 · updated 2026-06-17
• Weakness: CWE-639

Description

The Login No Captcha reCAPTCHA WordPress plugin before 1.7 doesn't check the proper IP address allowing attackers to spoof IP addresses on the allow list and bypass the need for captcha on the login screen.

Affected products

• Login No Captcha reCAPTCHA: before 1.7 — fixed in 1.7

How to fix

Upgrade to a fixed version: Login No Captcha reCAPTCHA 1.7. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/5231ac18-ea9a-4bb9-af9f-e3d95a3b54f1
• https://wpscan.com/vulnerability/5231ac18-ea9a-4bb9-af9f-e3d95a3b54f1

Get alerted when CVE-2022-2913 or the next vulnerability affects your stack