What is the CVSS score of CVE-2026-5415?

CVE-2026-5415 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of WP Captcha PRO are affected by CVE-2026-5415?

WP Captcha PRO and the associated Advanced Google reCAPTCHA plugin create a critical account takeover vulnerability affecting WordPress sites through version 5.38.

How to fix or mitigate CVE-2026-5415?

Within 24 hours: Immediately deactivate and remove WP Captcha PRO and Advanced Google reCAPTCHA plugins from all affected WordPress installations. Within 7 days: Conduct a complete audit of user accounts, reset credentials for all non-administrator users, and review WordPress admin access logs for unauthorized activity. Within 30 days: Deploy a WAF rule to block the vulnerable AJAX handler and transition to alternative CAPTCHA providers (Cloudflare Turnstile, Jetpack, or native solutions); monitor vendor communications for patch release.

WP Captcha PRO CVE-2026-5415

EUVD-2026-34888 HIGH

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-06-05 Wordfence

GHSA-f32q-xh2j-mm3g

WordPress Authentication Bypass Google Advanced Google Recaptcha Webfactory

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 19:20 vuln.today

CVE Published

Jun 05, 2026 - 18:31 nvd

HIGH 8.8

DescriptionCVE.org

The WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug) plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.38. This is due to the ajax_run_tool() AJAX handler relying solely on a nonce check (check_ajax_referer) for security without performing any capability check, combined with the create_temporary_link tool allowing the generation of passwordless login links for arbitrary users, and the handle_temporary_links() function authenticating visitors via these links without any additional authorization validation. The required nonce is exposed to all authenticated backend users (including Subscribers) via wp_localize_script() on all non-settings admin pages when the plugin's welcome pointer has not been dismissed. This makes it possible for authenticated attackers, with Subscriber-level access and above, to bypass normal authentication and log in as any user, including Administrators, resulting in complete account takeover.

AnalysisAI

Authentication bypass in WP Captcha PRO (and the free Advanced Google reCAPTCHA plugin sharing the same slug) for WordPress versions through 5.38 allows authenticated Subscriber-level users to log in as any account, including Administrator. The flaw chains a missing capability check in the ajax_run_tool() AJAX handler with the create_temporary_link tool that issues passwordless login links for arbitrary users, enabling full account takeover. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.

Technical ContextAI

The plugin is a WordPress security/CAPTCHA add-on developed by WebFactory (CPE cpe:2.3:a:webfactory:advanced_google_recaptcha), where the premium WP Captcha PRO and the free Advanced Google reCAPTCHA share the same plugin slug and codebase. The root cause is CWE-288 (Authentication Bypass Using an Alternate Path or Channel): the ajax_run_tool() AJAX endpoint enforces only a nonce check via check_ajax_referer() without calling current_user_can() or any role/capability gate. Because WordPress nonces are intended as CSRF tokens - not authorization controls - and the relevant nonce is broadcast to every logged-in user via wp_localize_script() on non-settings admin pages whenever the plugin's welcome pointer has not been dismissed, any authenticated session can invoke privileged tools. One such tool, create_temporary_link, generates passwordless magic-login URLs for arbitrary user IDs, which handle_temporary_links() then accepts and authenticates without further authorization validation.

RemediationAI

Upgrade to a version greater than 5.38 once published by WebFactory; the input data does not name a specific fixed release, so consult the vendor advisory at https://getwpcaptcha.com and the Wordfence entry at https://www.wordfence.com/threat-intel/vulnerabilities/id/8731565f-4d8a-49e6-9c38-6d4f5e51d68c?source=cve for the exact patched version (patch available per vendor advisory; released patched version not independently confirmed from input). Until the patched build is deployed, deactivate the plugin entirely (most reliable mitigation, at the cost of losing CAPTCHA protection on login/comment/registration forms - pair with another CAPTCHA plugin or temporarily disable open registration to compensate), or as a partial workaround disable open user registration in Settings > General (removes the Subscriber-self-enrollment path but does not protect sites with existing low-privilege accounts), and restrict /wp-admin and admin-ajax.php access by IP at the web server or WAF layer where feasible. A virtual patch blocking POST requests to admin-ajax.php with action=run_tool (or the plugin's specific action name) for non-administrator sessions can also be deployed via Wordfence, ModSecurity, or equivalent WAF rules.