What is the CVSS score of CVE-2026-5411?

CVE-2026-5411 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of WP Captcha PRO are affected by CVE-2026-5411?

WP Captcha PRO (Advanced Google reCAPTCHA plugin) versions through 5.38 contain a remote code execution vulnerability exploitable by any Subscriber-level user, enabling malicious PHP file uploads and…

How to fix or mitigate CVE-2026-5411?

Within 24 hours: Identify all WordPress installations running WP Captcha PRO; disable open user registration if not operationally critical; prepare rollback procedures. Within 7 days: Deactivate and remove the plugin or downgrade to version 5.37 pending patch availability; deploy WAF rules blocking POST requests to /wp-admin/admin-ajax.php with suspicious file parameters; audit recent uploads for webshells. Within 30 days: Conduct forensic scan of affected servers for unauthorized code execution artifacts; evaluate certified alternative CAPTCHA solutions; implement file integrity monitoring on wp-content/uploads.

WP Captcha PRO CVE-2026-5411

EUVD-2026-34889 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-06-05 Wordfence

GHSA-pvjf-9qxm-hpmx

File Upload WordPress Google RCE PHP

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 19:20 vuln.today

CVE Published

Jun 05, 2026 - 18:31 nvd

HIGH 8.8

DescriptionCVE.org

The WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug) plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 5.38. This is due to a capability check in the save_ajax() function of the licensing module, combined with unrestricted file extraction in sync_cloud_protection(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files including PHP webshells to the server by injecting a malicious cloud_protection_url into the license meta, which the plugin then downloads and extracts without file type validation into a web-accessible uploads directory. This can be used for remote code execution. Note: The vulnerability can only be exploited with a remote URL if "allow_url_fopen" is enabled in the php.ini config.

AnalysisAI

Remote code execution in WP Captcha PRO (premium version of the Advanced Google reCAPTCHA WordPress plugin) through version 5.38 allows authenticated Subscriber-level attackers to upload arbitrary files, including PHP webshells, by abusing the licensing module's save_ajax() capability check and the unrestricted archive extraction in sync_cloud_protection(). No public exploit identified at time of analysis, but the CVSS 8.8 rating and trivial Subscriber-level prerequisite - common on sites with open registration - make this a high-priority WordPress ecosystem flaw. Wordfence is the original reporter and primary intelligence source.

Technical ContextAI

The vulnerability resides in the licensing module of WP Captcha PRO, a commercial WordPress plugin (slug shared with the free Advanced Google reCAPTCHA per CPE cpe:2.3:a:webfactory:advanced_google_recaptcha) that integrates Google reCAPTCHA into login, registration, and comment flows. The flaw is a classic CWE-434 (Unrestricted Upload of File with Dangerous Type): the save_ajax() handler enforces an insufficient capability check that permits low-privilege users to persist a 'cloud_protection_url' value into license meta, which sync_cloud_protection() then fetches over HTTP and extracts (likely a ZIP archive) into a web-accessible wp-content/uploads subdirectory without validating member file extensions or MIME types. Because WordPress serves uploads directly and PHP execution is typically permitted there, dropped .php files become callable webshells. Remote URL fetching depends on PHP's allow_url_fopen INI setting being enabled (the default on most shared-hosting LAMP stacks).

RemediationAI

Upgrade WP Captcha PRO (and the free Advanced Google reCAPTCHA build sharing the same slug) to a version newer than 5.38 - exact fix version is not enumerated in the supplied data, so consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/92652339-ec86-4069-aeee-91c314ed2540 and the vendor page at https://getwpcaptcha.com for the patched release before deploying. If immediate patching is not feasible, the highest-impact compensating control is to deactivate and remove the plugin, which eliminates the vulnerable save_ajax() and sync_cloud_protection() code paths at the cost of losing reCAPTCHA protection on login/registration/comment forms (substitute with an alternative captcha plugin in the interim). Alternative mitigations include disabling open user registration in WordPress Settings → General (blocks the Subscriber prerequisite but breaks membership/e-commerce flows), setting allow_url_fopen=Off in php.ini (defeats the remote URL fetch but may break other plugins that rely on file_get_contents over HTTP), and adding a web server rule denying PHP execution under wp-content/uploads (mitigates webshell execution post-upload but can break legitimate plugins that ship PHP under uploads). A WAF rule blocking unauthenticated and Subscriber-level AJAX requests to the plugin's licensing save endpoint provides defense in depth while patching is scheduled.