CVE-2025-23693: 
WordPress vulnerability analysis and mitigation

Cross-Site Request Forgery (CSRF) vulnerability was discovered in Stanisław Skonieczny's Secure CAPTCHA WordPress plugin, affecting versions through 1.2. The vulnerability was disclosed on January 16, 2025, and allows attackers to perform Stored Cross-Site Scripting (XSS) attacks (NVD, Patchstack).

The vulnerability has been assigned a CVSS v3.1 Base Score of 7.1 (HIGH) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The vulnerability is classified under CWE-352 (Cross-Site Request Forgery) and allows attackers to execute unwanted actions under the authentication of privileged users (Patchstack).

The vulnerability enables attackers to perform Stored Cross-Site Scripting attacks through CSRF, potentially compromising the security of the website and its users. The impact is rated as LOW priority despite the high CVSS score, suggesting limited real-world exploitation potential (Patchstack).

The vulnerability can be exploited by unauthenticated attackers and requires user interaction. The attack can be initiated remotely, with low attack complexity (Patchstack).

Currently, there is no official fix available for this vulnerability. The security issue has been classified as having a low severity impact and is considered unlikely to be exploited (Patchstack).