{"id":"CVE-2026-125432","kind":"vulnerability","aliases":["CVE-2026-125432"],"related":[],"title":"WordPress reCAPTCHA for WooCommerce plugin: weak password recovery lets attackers reset passwords","description":"Weak Password Recovery Mechanism for Forgotten Password vulnerability in RelyWP reCAPTCHA for WooCommerce recaptcha-woo allows Password Recovery Exploitation.This issue affects reCAPTCHA for WooCommerce: from n/a through 1.4.7.","summary":"The reCAPTCHA for WooCommerce WordPress plugin by RelyWP has a weak password recovery mechanism in versions through 1.4.7. An attacker may be able to exploit the forgotten password flow to take over user accounts.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"recaptcha-woo","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["package","recaptcha-woo","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the `recaptcha-woo` plugin in the WordPress admin under Plugins, or in `wp-content/plugins/recaptcha-woo`.\n- Confirm whether the installed version is `1.4.7` or earlier.","fix":null,"status":"open","published_at":"2026-11-13T15:17:39+00:00","first_seen_at":"2026-11-13T15:46:17+00:00","triaged_at":"2026-11-13T15:50:06+00:00","updated_at":"2026-11-13T15:50:06+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-13T15:50:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress reCAPTCHA for WooCommerce plugin: weak password recovery lets attackers reset passwords","impact":"medium","summary":"The reCAPTCHA for WooCommerce WordPress plugin by RelyWP has a weak password recovery mechanism in versions through 1.4.7. An attacker may be able to exploit the forgotten password flow to take over user accounts.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","recaptcha-woo"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker resets accounts and takes over customer or admin logins","analyst_note":"Confirm the fixed version and the exact password recovery weakness from the vendor advisory or the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-125432.","how_to_check":"- Check the installed version of the `recaptcha-woo` plugin in the WordPress admin under Plugins, or in `wp-content/plugins/recaptcha-woo`.\n- Confirm whether the installed version is `1.4.7` or earlier.","plain_action":"","product_name":"recaptcha-woo","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the reCAPTCHA for WooCommerce plugin (recaptcha-woo) at version 1.4.7 or earlier are in scope, since the flaw sits in its password recovery flow. Sites that do not run this plugin are not affected. The sources do not state the exact conditions needed to exploit it.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000774,"input_tokens":4568,"output_tokens":635,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125432':15A,18A '-2026':14A,17A '1.4.7':45B,90C 'abl':50B 'account':61B 'affect':83C 'allow':78C 'attack':10A,47B 'cve':13A,16A 'exploit':52B 'exploitation.this':81C 'flow':56B 'forgotten':54B,67C 'issu':82C 'let':9A 'may':48B 'mechan':41B,65C 'n/a':88C 'packag':22B 'password':7A,12A,39B,55B,63C,68C,79C 'plugin':5A,33B 'recaptcha':2A,20A,24B,29B,72C,76C,84C 'recaptcha-woo':19A,23B,75C 'recoveri':8A,40B,64C,80C 'relywp':35B,71C 'reset':11A 'take':58B 'user':60B 'version':43B 'vulner':69C 'weak':6A,38B,62C 'woo':21A,25B,77C 'woocommerc':4A,26B,31B,74C,86C 'wordpress':1A,27B,32B","nicknames":[],"mitigations":[],"who_affected":"Sites running the reCAPTCHA for WooCommerce plugin (recaptcha-woo) at version 1.4.7 or earlier are in scope, since the flaw sits in its password recovery flow. Sites that do not run this plugin are not affected. The sources do not state the exact conditions needed to exploit it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["recaptchawoo"],"ptokens":["recaptcha","woo"],"labels":["medium","package","recaptchawoo","vendor","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-125432':15A,18A '-2026':14A,17A 'attack':10A 'cve':13A,16A 'let':9A 'password':7A,12A 'plugin':5A 'recaptcha':2A,20A 'recaptcha-woo':19A 'recoveri':8A 'reset':11A 'weak':6A 'woo':21A 'woocommerc':4A 'wordpress':1A","search_b":"'1.4.7':45B 'abl':50B 'account':61B 'attack':47B 'exploit':52B 'flow':56B 'forgotten':54B 'may':48B 'mechan':41B 'packag':22B 'password':39B,55B 'plugin':33B 'recaptcha':24B,29B 'recaptcha-woo':23B 'recoveri':40B 'relywp':35B 'take':58B 'user':60B 'version':43B 'weak':38B 'woo':25B 'woocommerc':26B,31B 'wordpress':27B,32B","search_c":"'1.4.7':90C 'affect':83C 'allow':78C 'exploitation.this':81C 'forgotten':67C 'issu':82C 'mechan':65C 'n/a':88C 'password':63C,68C,79C 'recaptcha':72C,76C,84C 'recaptcha-woo':75C 'recoveri':64C,80C 'relywp':71C 'vulner':69C 'weak':62C 'woo':77C 'woocommerc':74C,86C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T15:17:39+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125432","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125432","severity":null,"published_at":"2026-11-13T15:17:39+00:00","modified_at":"2026-11-13T15:17:39+00:00","first_seen_at":"2026-11-13T15:46:17+00:00","fetched_at":"2026-11-13T15:46:17+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}