CVE-2026-2374

Technical summary

The vulnerability stems from improper handling of the PHP_SELF superglobal in the plugin's authenticate() function. When a login attempt occurs from a non-standard URL, the plugin extracts the filename using basename($_SERVER['PHP_SELF']) and stores it unsanitized in the 'login_nocaptcha_error' WordPress option. The admin_notices() function later retrieves and outputs this value directly to the admin dashboard HTML without escaping or sanitization. An attacker can craft a malicious URL where PHP_SELF contains script tags—for example, by accessing wp-login.php?/evil.php%22onload=%22alert(1) or similar techniques—causing the stored payload to execute when admins view the dashboard. The time window of 30 seconds provides a practical exploitation window if the admin is monitoring login activity.

Business impact

This vulnerability allows attackers to execute arbitrary JavaScript in the administrative dashboard of affected WordPress sites. Potential impacts include credential theft via admin credential harvesting, installation of backdoors, plugin/theme modification, user privilege escalation, malware injection into published content, and defacement. Because the attack is stored and triggered upon admin dashboard access, it can affect multiple administrators if they log in during the exploitation window. Sites using this plugin's IP whitelist feature for access control are at higher risk since the feature suggests administrative sensitivity around site access.

Affected systems

All versions of the Login No Captcha reCAPTCHA WordPress plugin up to and including version 1.8.0 are vulnerable. The attack requires the plugin to be active and configured with IP whitelisting. WordPress installations on any hosting environment (shared, dedicated, or managed) are affected if they meet these conditions.

Exploitability

Exploitability is high. The vulnerability requires no authentication and no special user interaction beyond an administrator visiting their dashboard, which is routine behavior. An attacker can automate the attack by sending a crafted request to wp-login.php with a malicious PHP_SELF value, then waiting for any admin to access the dashboard. The 30-second window is sufficient for opportunistic attacks, and the ability to inject arbitrary JavaScript means attackers can capture credentials, inject backdoors, or perform other malicious actions with admin-level privileges. The CVSS score of 7.2 reflects this moderate-to-high severity due to network exploitability and stored persistence.

Remediation

Update the Login No Captcha reCAPTCHA plugin to a patched version released after version 1.8.0. Verify the specific version number against the plugin's official WordPress.org repository or the vendor's security advisory. Until patching is possible, deactivate and remove the plugin if not critical to operations. As a temporary mitigation, restrict wp-login.php and xmlrpc.php access via web server firewall rules or .htaccess to trusted IP ranges, though this does not fully address the underlying vulnerability.

Patch guidance

Visit the WordPress plugin repository page for Login No Captcha reCAPTCHA or check the vendor's official security advisory to identify the patched version number and release date. Download and install the latest available version once verified. Test the update in a staging environment first to ensure compatibility with your WordPress version and other plugins. After deployment, verify that the plugin is active and functioning correctly, and confirm that IP whitelisting rules still operate as expected. Monitor plugin changelogs for security patches regularly.

Detection guidance

Monitor WordPress admin dashboard access logs for unusual patterns, particularly logins from unexpected locations or times if your admin base is stable. Check the 'login_nocaptcha_error' option in the wp_options table for suspicious content using WordPress database queries or admin tools. Audit web server logs (Apache/Nginx access logs) for requests to wp-login.php containing URL-encoded script tags, percent-encoded characters, or paths like xmlrpc.php in the query string. Enable WordPress security logging plugins that capture authentication attempts and dashboard access. Look for JavaScript console errors or unexpected inline scripts in admin dashboard HTML when viewing the page source.

Why prioritize this

This vulnerability should be prioritized for immediate patching despite its moderate CVSS score. The attack is unauthenticated, has no user-interaction requirement from the attacker's perspective, and results in stored XSS with admin-level impact. Even sites without known active exploitation should patch urgently because the vulnerability is trivial to exploit and the impact—credential theft or backdoor installation—is severe. Sites with exposed or non-standard login URLs face elevated risk.

Risk score, explained

The CVSS 3.1 score of 7.2 (HIGH) is justified by a network-based attack vector, low attack complexity, no privilege requirements, and cross-scope impact. The vulnerability is unauthenticated and remotely exploitable with trivial effort. However, the score does not reflect the stored XSS nature, which increases real-world risk compared to reflected XSS. The 30-second execution window and IP whitelist requirement slightly reduce effective exploitability in practice, preventing a critical rating, but the stored persistence and admin context elevate it above typical moderate vulnerabilities.

Frequently asked questions