WP Captcha PRO EUVD-2026-34888

Requires (1) the WP Captcha PRO or Advanced Google reCAPTCHA plugin installed and active at version 5.38 or earlier, (2) an authenticated WordPress session at Subscriber level or above - trivially obtained on sites with open registration enabled, otherwise requiring credential compromise of any low-privilege account, (3) the plugin's welcome pointer not yet dismissed by an administrator, since that condition gates the wp_localize_script() nonce exposure on non-settings admin pages, and (4) network reach to /wp-admin/admin-ajax.php. No user interaction by a victim is required (UI:N), and the create_temporary_link tool accepts arbitrary target user IDs, so even with PR:L the attacker can pivot to Administrator. The welcome-pointer prerequisite and the registration model are the practical limiters: on sites where an admin has already dismissed the pointer, the nonce will not be exposed via that vector and exploitation through this exact path is blocked.

The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects real-world risk: exploitation is network-reachable, low-complexity, requires only low-privilege authentication (any Subscriber), needs no user interaction, and yields full confidentiality, integrity, and availability impact through Administrator takeover. WordPress sites that allow open user registration - common for membership, e-commerce, and community sites - effectively reduce the PR:L barrier to PR:N because attackers can self-register a Subscriber account. EPSS and KEV data were not provided in the input, and no public exploit is identified at time of analysis; however, Wordfence has published a threat-intel advisory, and the technical chain (nonce-only check + magic-login tool) is straightforward enough that weaponization by competent researchers is likely once details propagate. Treat as a high priority for any site running this plugin with open registration; medium-high priority elsewhere because any compromised low-privilege account becomes a path to full takeover.

An attacker registers a Subscriber account on a WordPress site (or compromises any existing low-privilege account), logs in, and loads any non-settings admin page where the plugin's welcome pointer is still active, harvesting the AJAX nonce from the wp_localize_script() output. They then POST to admin-ajax.php invoking ajax_run_tool() with the create_temporary_link tool targeting user ID 1 (the typical Administrator), receive a passwordless magic-login URL, and visit it to be authenticated as Administrator with full site control. No public exploit is identified at time of analysis, but the chain is reproducible from the public description.