WP Cryptographp CAPTCHA bypass vulnerability

Posted by DK

November 22, 2007

Mustlive at it again. This time he has broken the Captcha system for the Cryptographp plugin for WordPress. To quote him:

Statistics at wordpress.org said that this plugin was downloaded 6285 times. And taking into account that this plugin also can be downloaded from others sources, so total amount of downloads and sites which use this plugin is much more. So there are many thousands of sites which are in risk with this plugin.

This captcha is vulnerable for session reusing with constant captcha bypass method. This Insufficient Anti-automation hole I found 15.11.2007.

No known fix available as yet.