SweetCaptcha WordPress Vulnerability – Popups & Adware

SweetCaptcha for WordPress used to be a pretty cool and effective plugin.  It brought all the advantages of preventing comment spam without the annoying, hard to read letters and number you would hope you entered right.

Well, sorry for anybody who has used or may be using this plugin, it’s time to find another solution.  The issues first started arising about a week ago when we began getting reports of spam popups on some of our users WordPress sites.  Now, the first thought is maybe the WordPress site was compromised or hacked (whatever you want to call it) but all the sites were hosted on our servers and are kept extremely up to date so that was highly unlikely.  We moved on.  Second possibility, maybe it was the users computer that was infected, NOT the actual website.  This was quickly written off as well once the multiple reports began coming in.  We don’t believe in coincidences.  Finally, we started looking at the plugins and quickly found the culprit – SweetCaptcha.

This was pretty easily confirmed with this great post by Sucuri and then further confirmed when we realized WordPress had completely removed the plugin from its repository.

So if you have the SweetCaptcha security plugin installed on your site, we would highly recommend removing it as soon as possible.  While it is not harmful to your site, you are probably discouraging visitors with annoying, spam like popups that could poise dangers to their individual computers.

Need further assistance maintaining your WordPress website?  Want to get vulnerabilities related to your specific site caught early?  Checkout our maintenance plans starting at only $25/month.