JezK

Edit File: Recaptcha.php

<?php
/**
 * Google reCAPTCHA support
 *
 * Verifies a reCAPTCHA token against Google's siteverify endpoint using the
 * keys configured in the Kirki admin common data option.
 *
 * @package kirki
 */

namespace Kirki\App\Supports;

use Kirki\Framework\Http\Response;
use Kirki\Framework\Supports\Facades\Http;
use Kirki\App\Supports\Session;
use RuntimeException;

if (!defined('ABSPATH')) {
	exit; // Exit if accessed directly.
}

class Recaptcha
{
	/**
	 * Google reCAPTCHA verification endpoint.
	 *
	 * @var string
	 */
	public const VERIFY_URL = 'https://www.google.com/recaptcha/api/siteverify';

/**
	 * Verify a reCAPTCHA token.
	 *
	 * No-op when no token is supplied (matches the legacy behaviour where the
	 * check only runs if the front-end sent a token). Throws on misconfiguration
	 * or a failed verification so the caller can abort the request.
	 *
	 * @param array|null $params Get the reCAPTCHA token from the submission params.
	 * @param string|null $form_id The form ID.
	 * @return void
	 *
	 * @throws RuntimeException When configuration is missing or verification fails.
	 */
	public static function verify(?array $params = [], ?string $form_id = null)
	{
		$session_data = Session::get($form_id);
		$recaptcha = $session_data['recaptcha'] ?? [];

if (empty($recaptcha)) {
			return;
		}

if (!isset($recaptcha['GRC_version'])) {
			throw new RuntimeException(
				esc_html__('reCAPTCHA configuration not found', 'kirki'),
				(int) Response::BAD_REQUEST
			);
		}

$token = $recaptcha['GRC_version'] === '2.0' ? ($params['g-recaptcha-response'] ?? '') : ($params['g-recaptcha-token'] ?? '');

if (empty($token)) {
			throw new RuntimeException(
				esc_html__('Recaptcha is required.', 'kirki'),
				(int) Response::BAD_REQUEST
			);
		}

$secret_key = $recaptcha['GRC_secret_key'] ?? '';

if (empty($secret_key)) {
			throw new RuntimeException(
				esc_html__('reCAPTCHA secret key not configured', 'kirki'),
				(int) Response::BAD_REQUEST
			);
		}

if (!static::is_token_valid($secret_key, $token)) {
			throw new RuntimeException(
				esc_html__('Google reCAPTCHA verification failed', 'kirki'),
				(int) Response::BAD_REQUEST
			);
		}
	}

/**
	 * Call Google's siteverify endpoint for the given token.
	 *
	 * @param string $secret_key The reCAPTCHA secret key.
	 * @param string $token      The reCAPTCHA token.
	 * @return bool
	 */
	protected static function is_token_valid(string $secret_key, string $token)
	{
		$response = Http::as_form()->post(
			static::VERIFY_URL,
			[
				'secret' => $secret_key,
				'response' => $token,
			]
		);

if ($response->failed()) {
			return false;
		}

return (bool) $response->json('success');
	}
}