CVE-2023-48745: 
WordPress vulnerability analysis and mitigation

The WordPress Captcha Code plugin, developed by WebFactory Ltd, was found to contain a Captcha Bypass vulnerability (CVE-2023-48745) affecting versions 2.9 and below. The vulnerability was discovered by researcher qilin_99 on July 29, 2023, and was publicly disclosed on November 24, 2023 (Patchstack).

The vulnerability is classified as an Improper Restriction of Excessive Authentication Attempts, allowing unauthenticated attackers to bypass the Captcha verification functionality. The severity is rated as Low with a CVSS score of 5.3, and it falls under the OWASP Top 10 category A5: Security Misconfiguration (Patchstack, WPScan).

The vulnerability allows malicious actors to bypass the CAPTCHA verification system, potentially compromising the security measures intended to prevent automated attacks on forms protected by the plugin (WPScan).

The vulnerability can be exploited by unauthenticated users, though it has been assessed as having a low likelihood of exploitation (Patchstack).

The vulnerability has been fixed in version 3.0 of the Captcha Code plugin. Users are advised to update to version 3.0 or later to remove the vulnerability. For Patchstack users, enabling auto-update for vulnerable plugins is recommended (Patchstack).