In reCAPTCHA's API (without plugin), the key part is
<iframe src="http://www.google.com/recaptcha/api/noscript?k=your_public_key" height="300" width="500" frameborder="0"></iframe><br> <textarea name="recaptcha_challenge_field" rows="3" cols="40"> </textarea> <input type="hidden" name="recaptcha_response_field" value="manual_challenge">
The website embedding this API actually asks the user to retrieve a iframe from reCAPTCHA using a public key. Suppose stackexchange is using reCAPTCHA and it has a public key A. And I want to attack stackexchange by circumventing its CAPTCHA.
Suppose I have a website that has some legitimate users. I can embed a reCAPTCHA API in my website that using public key A, which is stackexchange's reCAPTCHA public key. Now after the users of mine solve the CAPTCHA, they will submit a CAPTCHA challenge id and solution to my website. After that, I can submit the same challenge id and solution to stackexchange using a automated script. Then I successfully bypass the CAPTCHA challenge of stackexchange.
I am not sure whether this attack is practical or not. Suppose the browser of my users do not fill the HTTP referrer field in the request to reCAPTCHA, which prevents reCAPTCHA knowing that my website is actually using stackexchange's public key.