Ibtana WordPress Website Builder Missing Capability Check Vulnerability Allowing Unauthorized reCAPTCHA Bypass

A vulnerability exists in the Ibtana - WordPress Website Builder plugin, affecting all versions up to and including 1.2.3.3. The issue arises from a missing capability check in the 'ibtana_visual_editor_register_ajax_json_endpont' function, which allows unauthenticated attackers to modify data. Specifically, attackers can update reCAPTCHA keys stored in WordPress options, potentially bypassing reCAPTCHA protections on the site.

Impact

Exploitation of this vulnerability allows for unauthorized modification of reCAPTCHA settings, enabling attackers to bypass reCAPTCHA protections on the affected WordPress site.

Remediation

Users are advised to update the Ibtana - WordPress Website Builder plugin to version 1.2.3.4 or a newer patched version.