CVE-2026-97317: Giveaways and Contests by RafflePress < 1.12.27 - Unauthenticated reCAPTCHA Secret Key Disclosure via Giveaway Page
The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not remove the reCAPTCHA secret key from the giveaway settings it embeds in public giveaway pages, allowing unauthenticated visitors to retrieve the secret key of any active giveaway that has reCAPTCHA configured.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Giveaways and Contests by RafflePressto a version that resolves this vulnerability.Fixed in 1.12.27
Event History
Frequently Asked Questions
Who can retrieve the exposed reCAPTCHA secret key?
Any unauthenticated visitor can retrieve it from a public giveaway page for an active giveaway where reCAPTCHA is configured. No account or user interaction is required.
Which deployments are affected?
The issue affects versions of the Giveaways and Contests by RafflePress WordPress plugin before 1.12.27. Exposure occurs when an active giveaway has reCAPTCHA configured and its giveaway page is publicly accessible.
How can I determine whether a key has been exposed?
Review public pages for active giveaways with reCAPTCHA enabled and inspect the giveaway settings embedded in those pages. If the reCAPTCHA secret key is present in the publicly delivered page data, it has been exposed.
What should be done if exposure is suspected?
Update the plugin to version 1.12.27 or later. Because the secret key may already have been retrieved, replace the affected reCAPTCHA secret key after updating.