> DVWA: Insecure recaptcha

...
	// Show next stage for the user
	echo "
	<pre><br />You passed the CAPTCHA! Click the button to confirm your changes.<br /></pre>
	<form action=\"#\" method=\"POST\">
	<input type=\"hidden\" name=\"step\" value=\"2\" />
	<input type=\"hidden\" name=\"password_new\" value=\"{$pass_new}\" />
	<input type=\"hidden\" name=\"password_conf\" value=\"{$pass_conf}\" />
	<input type=\"hidden\" name=\"passed_captcha\" value=\"true\" />
	<input type=\"submit\" name=\"Change\" value=\"Change\" />
	</form>";
} 
...
// Check to see if they did stage 1
    if( !$_POST[ 'passed_captcha' ] ) {
        $html     .= "<pre><br />You have not passed the CAPTCHA.</pre>";
        $hide_form = false;
        return;
    }