{"id":"CVE-2024-3940","aliases":["EUVD-2024-32507","GHSA-3g3h-99q7-v8x2"],"status":"published","title":"reCAPTCHA Jetpack \u003c= 0.2.2 - Settings Update via CSRF","description":"The reCAPTCHA Jetpack WordPress plugin through 0.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00381,"percentile":0.32493,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-352"],"published":"2024-05-10T06:00:02Z","modified":"2026-10-28T02:31:01Z","products":[{"vendor":"bozdoz","product":"recaptcha jetpack"},{"vendor":"bozdoz","product":"recaptcha_jetpack"},{"vendor":"unknown","product":"recaptcha jetpack"}],"references":[{"url":"https://wpscan.com/vulnerability/bb0245e5-8e94-4f11-9003-d6208945056c/","tags":["exploit","vdb-entry","technical-description","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-3940","tags":["advisory"]},{"url":"https://wpscan.com/vulnerability/bb0245e5-8e94-4f11-9003-d6208945056c"},{"url":"https://github.com/advisories/GHSA-3g3h-99q7-v8x2"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/3xxx/CVE-2024-3940.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-3940","title":"reCAPTCHA Jetpack \u003c= 0.2.2 - Settings Update via CSRF","description":"The reCAPTCHA Jetpack WordPress plugin through 0.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack","status":"published","published":"2024-05-10T06:00:02.589Z","modified":"2025-03-24T16:30:46.012Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"updated_at":"2026-11-02T14:34:10.258163Z"}],"euvd":[{"id":"EUVD-2024-32507","description":"The reCAPTCHA Jetpack WordPress plugin through 0.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack","status":"published","published":"2024-05-10T06:00:02Z","modified":"2025-03-24T16:30:46Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:54.592858Z"}],"ghsa":[{"id":"GHSA-3g3h-99q7-v8x2","title":"The reCAPTCHA Jetpack WordPress plugin through 0.2.2 does not have CSRF check in place when...","description":"The reCAPTCHA Jetpack WordPress plugin through 0.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack","status":"published","published":"2024-05-14T18:30:53Z","modified":"2025-05-05T18:32:50Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:02:07.480076Z"}],"nvd":[{"id":"CVE-2024-3940","description":"The reCAPTCHA Jetpack WordPress plugin through 0.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack","status":"published","published":"2024-05-14T15:42:36.773Z","modified":"2026-06-17T07:45:31.273Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:09:58.124007Z"}],"osv":[{"id":"CVE-2024-3940","title":"reCAPTCHA Jetpack \u003c= 0.2.2 - Settings Update via CSRF","description":"The reCAPTCHA Jetpack WordPress plugin through 0.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack","status":"published","published":"2024-05-10T06:00:02.589Z","modified":"2026-10-28T02:31:01.095178271Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:41.618074Z"}]}}