WordPress Multiple Plugins Captcha Bypass Vulnerabilities

Bugtraq ID:	37108
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 03 2007 12:00AM
Updated:	Nov 24 2009 04:45PM
Credit:	MustLive
Vulnerable:	WordPress reCaptcha 0 WordPress Peter's Custom Anti-Spam Image CAPTCHA 0 WordPress Math Comment Spam Protection 2.1 WordPress Dumb Math Captcha 1.0 WordPress Cryptographp 1.2 WordPress Anti Spam Image CAPTCHA 0.5
Not Vulnerable:

WordPress Multiple Plugins Captcha Bypass Vulnerabilities

Multiple plugins for WordPress are prone to CAPTCHA-bypass issues.

Attackers can leverage these issues to bypass the CAPTCHA check and perform unauthorized actions.

These issues affect the following:

Dumb Math Captcha for WordPress 1.0
Peter's Custom Anti-Spam Image CAPTCHA
reCaptcha
Cryptographp 1.2
Math Comment Spam Protection 2.1
Anti Spam Image CAPTCHA 0.5

WordPress Multiple Plugins Captcha Bypass Vulnerabilities

Attackers can use a browser to exploit these issues.

WordPress Multiple Plugins Captcha Bypass Vulnerabilities

Solution:
Some of these issues are reported fixed. Please see the references for details.

WordPress Multiple Plugins Captcha Bypass Vulnerabilities

References:

• MoBiC-03: Peter's Custom Anti-Spam Image CAPTCHA bypass (MustLive)
  
• MoBiC-04: reCaptcha CAPTCHA bypass (MustLive)
  
• MoBiC-12: Peter's Random Anti-Spam Image CAPTCHA bypass (MustLive)
  
• MoBiC-16: Cryptographp CAPTCHA bypass (MustLive)
  
• MoBiC-23: Math Comment Spam Protection CAPTCHA bypass (MustLive)
  
• MoBiC-25: Anti Spam Image CAPTCHA bypass (MustLive)
  
• Vulnerabilities in Dumb math captcha for WordPress (MustLive)
  
• Vulnerability Dumb math captcha plugin for WordPress (MustLive)
  
• Wordpress church_admin Plugin "id" Cross-Site Scripting Vulnerability (Sammy Forgit)
  
• Vulnerabilities in plugins for WordPress (MustLive)