WP Captcha PRO EUVD-2026-34889

Exploitation requires three concrete conditions: (1) the attacker holds a valid WordPress account at Subscriber level or higher on the target site - trivially obtained where wp-login.php registration is open or memberships/WooCommerce customer accounts are enabled; (2) the WP Captcha PRO plugin (or the same-slug free Advanced Google reCAPTCHA edition) at version 5.38 or earlier is installed and active; (3) the PHP runtime has allow_url_fopen enabled in php.ini, which is the default in mainstream PHP builds and on most shared hosting. Limiting factors that reduce real-world reach are sites that disable open registration, hosts that ship with allow_url_fopen=Off, and any web server configuration that denies PHP execution under wp-content/uploads. No user interaction is required from an administrator, and the network attack vector means exploitation is possible from anywhere the WordPress AJAX endpoint is reachable.

Multiple signals converge on a real, high-priority risk on exposed WordPress installs. CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network-reachable, low-complexity, low-privilege RCE with full CIA impact and no user interaction - Subscriber accounts are routinely created by WordPress's default open-registration flow on sites with comments, memberships, or e-commerce. There is no KEV listing and no EPSS score in the supplied data, and no public exploit identified at time of analysis, which tempers immediate mass-exploitation risk but does not lower the patch urgency given the trivial preconditions and Wordfence's public disclosure. The allow_url_fopen requirement is a meaningful but weak limiter - it is enabled by default in mainstream PHP distributions and most shared hosting. Note one limitation in the source data: no fix version is provided in the supplied references, so 'all versions up to and including 5.38' must be verified against the Wordfence advisory and the vendor changelog before relying on a specific patched build.

An attacker registers a Subscriber account on a target WordPress site (or compromises an existing low-privilege user), then issues an authenticated AJAX request to the plugin's licensing save_ajax() handler, planting a cloud_protection_url pointing to an attacker-controlled ZIP archive containing a PHP webshell. The attacker triggers sync_cloud_protection(), which fetches the archive via allow_url_fopen and extracts it into wp-content/uploads without extension validation, then requests the dropped .php file directly to gain remote code execution under the web server user. No public exploit has been identified at time of analysis, but the documented mechanism is straightforward to weaponize against any registration-enabled site.