CVE-2024-5541
Ibtana - WordPress Website Builder <= 1.2.3.3 - Unauthenticated reCAPTCHA Settings Update
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
The Ibtana – WordPress Website Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ibtana_visual_editor_register_ajax_json_endpont' function in all versions up to, and including, 1.2.3.3. This makes it possible for unauthenticated attackers to update option values for reCAPTCHA keys on the WordPress site. This can be leveraged to bypass reCAPTCHA on the site. CVE-2024-37123 is likely a duplicate of this issue.
| CWE | CWE-862 |
| Vendor | vowelweb |
| Product | ibtana – wordpress website builder |
| Published | Jun 18, 2024 |
| Last Updated | Apr 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for vowelweb ibtana – wordpress website builder
Be the first to know when new medium vulnerabilities affecting vowelweb ibtana – wordpress website builder are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
vowelweb / Ibtana – WordPress Website Builder
0 ≤ 1.2.3.3
References
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/e022febe-7295-493d-afa7-185f55b4d3b9?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/ibtana-visual-editor/trunk/admin/settings.php#L9 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/ibtana-visual-editor/trunk/dist/blocks.build.js plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset/3103454/ibtana-visual-editor/trunk/admin/settings.php
Credits
Peter Thaleikis