CVE-2026-125432: WordPress reCAPTCHA for WooCommerce plugin <= 1.4.7 - Broken Authentication vulnerability

Q: Which installations are affected?

RelyWP reCAPTCHA for WooCommerce versions through 1.4.7 are affected. The available information does not identify a lower fixed or unaffected version.

Q: Does exploiting this issue require an authenticated account or user interaction?

No. The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.

Q: What is the likely security impact?

The issue is described as a weak forgotten-password recovery mechanism that permits password recovery exploitation. The CVSS assessment indicates integrity impact, with no stated confidentiality or availability impact.

Published Nov 13, 2026

Updated

Weak Password Recovery Mechanism for Forgotten Password vulnerability in RelyWP reCAPTCHA for WooCommerce recaptcha-woo allows Password Recovery Exploitation.This issue affects reCAPTCHA for WooCommerce: from n/a through 1.4.7.

Affected Software

1 affected component

RelyWP reCAPTCHA for WooCommerce<=1.4.7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.5.0

Event History

Nov 13, 2026

CVE Published

via MITRE·03:08 PM

Data Sourced

via MITRE·03:08 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

RelyWP reCAPTCHA for WooCommerce versions through 1.4.7 are affected. The available information does not identify a lower fixed or unaffected version.

Does exploiting this issue require an authenticated account or user interaction?

No. The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.

What is the likely security impact?

The issue is described as a weak forgotten-password recovery mechanism that permits password recovery exploitation. The CVSS assessment indicates integrity impact, with no stated confidentiality or availability impact.

CVE-2026-125432: WordPress reCAPTCHA for WooCommerce plugin <= 1.4.7 - Broken Authentication vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which installations are affected?

Does exploiting this issue require an authenticated account or user interaction?

What is the likely security impact?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

Does exploiting this issue require an authenticated account or user interaction?

What is the likely security impact?