CVE-2026-97317: Giveaways and Contests by RafflePress < 1.12.27 - Unauthenticated reCAPTCHA Secret Key Disclosure via Giveaway Page

Q: Who can retrieve the exposed reCAPTCHA secret key?

Any unauthenticated visitor can retrieve it from a public giveaway page for an active giveaway where reCAPTCHA is configured. No account or user interaction is required.

Q: Which deployments are affected?

The issue affects versions of the Giveaways and Contests by RafflePress WordPress plugin before 1.12.27. Exposure occurs when an active giveaway has reCAPTCHA configured and its giveaway page is publicly accessible.

Q: How can I determine whether a key has been exposed?

Review public pages for active giveaways with reCAPTCHA enabled and inspect the giveaway settings embedded in those pages. If the reCAPTCHA secret key is present in the publicly delivered page data, it has been exposed.

Q: What should be done if exposure is suspected?

Update the plugin to version 1.12.27 or later. Because the secret key may already have been retrieved, replace the affected reCAPTCHA secret key after updating.

Published Oct 2, 2026

Updated

The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not remove the reCAPTCHA secret key from the giveaway settings it embeds in public giveaway pages, allowing unauthenticated visitors to retrieve the secret key of any active giveaway that has reCAPTCHA configured.

Affected Software

1 affected component

RafflePress Giveaways and Contests by RafflePress<1.12.27

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Giveaways and Contests by RafflePress to a version that resolves this vulnerability.
Fixed in 1.12.27

Event History

Oct 2, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can retrieve the exposed reCAPTCHA secret key?

Any unauthenticated visitor can retrieve it from a public giveaway page for an active giveaway where reCAPTCHA is configured. No account or user interaction is required.

Which deployments are affected?

The issue affects versions of the Giveaways and Contests by RafflePress WordPress plugin before 1.12.27. Exposure occurs when an active giveaway has reCAPTCHA configured and its giveaway page is publicly accessible.

How can I determine whether a key has been exposed?

Review public pages for active giveaways with reCAPTCHA enabled and inspect the giveaway settings embedded in those pages. If the reCAPTCHA secret key is present in the publicly delivered page data, it has been exposed.

What should be done if exposure is suspected?

Update the plugin to version 1.12.27 or later. Because the secret key may already have been retrieved, replace the affected reCAPTCHA secret key after updating.

CVE-2026-97317: Giveaways and Contests by RafflePress < 1.12.27 - Unauthenticated reCAPTCHA Secret Key Disclosure via Giveaway Page

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can retrieve the exposed reCAPTCHA secret key?

Which deployments are affected?

How can I determine whether a key has been exposed?

What should be done if exposure is suspected?

Company

Resources

Contact

Frequently Asked Questions

Who can retrieve the exposed reCAPTCHA secret key?

Which deployments are affected?

How can I determine whether a key has been exposed?

What should be done if exposure is suspected?