CVE-2026-5411: WP Captcha PRO Arbitrary File Upload & Remote Code Execution

Technical summary

CVE-2026-5411 affects WP Captcha PRO through version 5.38 and involves a combination of two weaknesses in the licensing module. The save_ajax() function fails to properly enforce capability checks, allowing lower-privileged authenticated users to modify license metadata. The sync_cloud_protection() function then processes this metadata without validating file types or archive contents during extraction. When allow_url_fopen is enabled on the server, an attacker can inject a malicious cloud_protection_url into the license meta, causing the plugin to fetch and extract an attacker-controlled archive directly into the WordPress uploads directory (or other web-accessible paths). No file type restrictions are enforced during extraction, permitting PHP files and webshells to be written to disk and executed by the web server.

Business impact

Successful exploitation enables complete server compromise through remote code execution. An attacker can establish persistent backdoors, steal sensitive data including customer information and database credentials, modify website content, inject malware for further distribution, or launch attacks against your infrastructure and connected systems. The attack surface is broad because it only requires Subscriber-level access—a privilege level often held by numerous users, including contributors, temporary staff, or compromised accounts. For multi-site WordPress installations, a single compromised account poses organization-wide risk.

Affected systems

All versions of WP Captcha PRO up to and including version 5.38 are vulnerable. The Advanced Google reCAPTCHA plugin (free version) shares the same slug but has not been identified as affected by this specific vulnerability. Exploitation requires: (1) WP Captcha PRO to be active, (2) the attacker to have authenticated access at Subscriber level or higher, and (3) the target server to have allow_url_fopen enabled in php.ini. Systems with allow_url_fopen disabled mitigate remote URL exploitation, though local file inclusion vectors should be evaluated.

Exploitability

Exploitation is straightforward once initial access is obtained. The attack requires no user interaction, no clicking of malicious links by administrators, and succeeds reliably if conditions are met. The primary barrier is obtaining valid WordPress credentials; however, Subscriber access is the lowest privileged user role that can log in, making credential compromise, account enumeration, or brute force attacks realistic threat scenarios. No advanced exploitation skills are needed—the vulnerability is a logical flaw rather than a memory corruption or timing-dependent issue. The CVSS score of 8.8 (HIGH) reflects the ease of exploitation and severity of impact.

Remediation

Update WP Captcha PRO to the first patched version released after 5.38. Verify the availability of a patched release through the plugin's official repository or vendor advisory before upgrading. Additionally, review and restrict PHP configurations: disable allow_url_fopen in php.ini if not required by other applications, implement strict file upload restrictions at the web server level, and enforce principle of least privilege for WordPress user roles. Audit existing user accounts and revoke unnecessary Subscriber+ permissions. Consider implementing Web Application Firewall (WAF) rules to detect and block suspicious license meta modifications.

Patch guidance

Apply updates as soon as a patched version is released. Visit the WordPress Plugin Directory or contact the plugin vendor directly to confirm the version that resolves this vulnerability. Before deployment, test patches in a staging environment to ensure compatibility with active themes and plugins. If you are unable to patch immediately, apply compensating controls: disable allow_url_fopen, restrict Subscriber+ account creation, monitor license-related database changes, and disable the cloud protection feature if not essential. Document the timeline for patching and communicate urgently with stakeholders given the HIGH severity rating.

Detection guidance

Monitor WordPress user accounts with Subscriber level or above for suspicious activity. Log and alert on modifications to the 'license' or 'cloud_protection_url' meta fields, particularly if modified by non-admin accounts. Check web server access logs for unusual file creation events in the uploads directory, especially for PHP files. Use security plugins or WAF rules to inspect POST requests to the licensing module's save_ajax() function for anomalous metadata. Examine the wp-uploads directory for newly created files with unexpected MIME types (e.g., PHP within a ZIP or TAR archive). Correlate file creation timestamps with user login events to identify the source. Review web server error logs for execution of PHP files in unusual locations.

Why prioritize this

This vulnerability merits immediate attention due to its HIGH CVSS score (8.8), low barrier to exploitation, and direct path to remote code execution. Unlike vulnerabilities requiring administrative access or complex social engineering, this threat can be realized by any user account at Subscriber level or above. Given the commonality of WordPress sites and the potential for widespread WordPress account compromise through credential stuffing or weak passwords, the risk to your infrastructure is substantial. The lack of CISA KEV status does not diminish urgency; internal prioritization should treat this as critical.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) is driven by: (1) Network vector (AV:N)—attack is remote, (2) Low complexity (AC:L)—no special conditions required beyond basic authentication, (3) Low privilege requirement (PR:L)—Subscriber role is the lowest user level, (4) No user interaction needed (UI:N), (5) Unchanged scope (S:U), and (6) High impact across confidentiality, integrity, and availability (C:H/I:H/A:H)—full system compromise via code execution. This score accurately reflects the severity and exploitability of the vulnerability.

Frequently asked questions