CVE-2026-97317
Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: WPScan

Description
The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not remove the reCAPTCHA secret key from the giveaway settings it embeds in public giveaway pages, allowing unauthenticated visitors to retrieve the secret key of any active giveaway that has reCAPTCHA configured.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-02
Last Modified
2026-10-02
Generated
2026-10-19
AI Q&A
2026-10-02
EPSS Evaluated
2026-10-18
NVD
CVE-2026-97317
EUVD
EUVD-2026-91196

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Giveaways and Contests by RafflePress 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability in the Giveaways and Contests by RafflePress WordPress plugin before version 1.12.27 allows unauthenticated visitors to retrieve the reCAPTCHA secret key from public giveaway pages. This occurs because the plugin does not remove the secret key from embedded settings on these pages.

Detection Guidance

To detect this vulnerability, check if your WordPress site uses the Giveaways and Contests by RafflePress plugin version prior to 1.12.27. Inspect public giveaway pages for exposed reCAPTCHA secret keys in embedded settings. Use commands like 'curl' to fetch page source and search for 'recaptcha' or 'secret key' patterns.

Impact Analysis

This vulnerability can lead to sensitive data exposure, specifically the reCAPTCHA secret key, which could be exploited by attackers to bypass reCAPTCHA protections on websites using the plugin.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to the exposure of reCAPTCHA secret keys. Unauthorized access to these keys may enable attackers to bypass security measures, potentially leading to unauthorized data collection or processing, which violates data protection requirements under these regulations.

Mitigation Strategies

Immediately update the Giveaways and Contests by RafflePress plugin to version 1.12.27 or later. Review and remove any exposed reCAPTCHA secret keys from public giveaway pages. Monitor for unauthorized access or suspicious activity related to reCAPTCHA keys.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97317. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart