CVE-2026-5411: WP Captcha PRO RCE Vulnerability

CVE-2026-5411 Overview

CVE-2026-5411 is an arbitrary file upload vulnerability in the WP Captcha PRO plugin for WordPress, the premium edition of the Advanced Google reCAPTCHA plugin. All versions up to and including 5.38 are affected. The flaw resides in the licensing module, where the save_ajax() function performs an insufficient capability check and the sync_cloud_protection() function extracts archives without file type validation. Authenticated attackers with Subscriber-level access can inject a malicious cloud_protection_url into the license meta. The plugin then downloads the remote archive and extracts its contents, including PHP webshells, into a web-accessible uploads directory. This results in remote code execution under the web server context [CWE-434].

Critical Impact
Authenticated Subscriber accounts can achieve remote code execution by uploading PHP webshells through the plugin's license synchronization workflow.

Affected Products

WP Captcha PRO plugin for WordPress (versions ≤ 5.38)
Advanced Google reCAPTCHA plugin for WordPress (shared slug, versions ≤ 5.38)
WordPress sites with allow_url_fopen enabled in php.ini

Discovery Timeline

2026-06-05 - CVE-2026-5411 published to NVD
2026-06-05 - Last updated in NVD database

Technical Details for CVE-2026-5411

Vulnerability Analysis

The vulnerability chains two weaknesses in the WP Captcha PRO licensing module. The save_ajax() AJAX handler enforces only a low-privilege capability check, allowing any authenticated user including Subscribers to write to the plugin's license metadata. One of the controllable fields is cloud_protection_url, which the plugin trusts as a legitimate source for cloud-based protection definitions.

When the plugin invokes sync_cloud_protection(), it fetches the resource referenced by cloud_protection_url and extracts it into a directory beneath the WordPress uploads path. The extraction routine does not validate file extensions, MIME types, or archive entry names. An attacker-controlled archive containing PHP files is unpacked to a location reachable through the web server, enabling direct execution of attacker code.

Root Cause

The root cause is a combination of broken access control on a sensitive AJAX endpoint and missing file type validation during archive extraction [CWE-434]. The plugin treats Subscriber capability as sufficient for modifying license metadata that drives remote file retrieval and extraction. There is no allow-list of file extensions, no integrity check on the downloaded payload, and no isolation of the extraction target outside the web root.

Attack Vector

Exploitation requires an authenticated account at the Subscriber role or higher and a target server with allow_url_fopen enabled in php.ini when a remote URL is used. The attacker logs in, sends a crafted AJAX request to save_ajax() to set cloud_protection_url to an attacker-hosted archive containing a PHP webshell, then triggers sync_cloud_protection(). The webshell is written to the uploads directory and invoked over HTTP to gain remote code execution as the web server user.

No verified proof-of-concept code is published. Refer to the Wordfence advisory linked
in the references for additional technical details on the vulnerable functions
save_ajax() and sync_cloud_protection().

Detection Methods for CVE-2026-5411

Indicators of Compromise

Unexpected .php files appearing within wp-content/uploads/ subdirectories created by the WP Captcha PRO plugin.
Outbound HTTP requests from the WordPress host fetching archives referenced by the cloud_protection_url license meta field.
WordPress usermeta or plugin license records containing an externally controlled cloud_protection_url value.
Webshell-style HTTP requests targeting files inside the uploads directory with query parameters such as cmd= or exec=.

Detection Strategies

Audit WordPress access logs for POST requests to admin-ajax.php with the WP Captcha PRO save_ajax action originating from Subscriber accounts.
Monitor file integrity on wp-content/uploads/ for newly created executable script files.
Inspect plugin license metadata for non-vendor URLs in the cloud_protection_url field.

Monitoring Recommendations

Alert on PHP script execution within the uploads directory using web server or WAF rules.
Correlate authentication events for low-privilege accounts with subsequent plugin AJAX activity.
Capture and review egress traffic from the WordPress host to identify retrieval of archives from untrusted domains.

How to Mitigate CVE-2026-5411

Immediate Actions Required

Update WP Captcha PRO and the Advanced Google reCAPTCHA plugin to a version newer than 5.38 once the vendor publishes a fix.
Audit all WordPress accounts and remove unused Subscriber-level users that could be leveraged for exploitation.
Search wp-content/uploads/ for unauthorized PHP files and remove any webshells found.
Review plugin license metadata and reset any attacker-controlled cloud_protection_url values.

Patch Information

Review the Wordfence Vulnerability Report and the WP Captcha vendor site for the latest fixed version. Apply the patched release through the WordPress plugin updater as soon as it is available.

Workarounds

Disable WP Captcha PRO until a patched version is installed.
Set allow_url_fopen=Off in php.ini to block remote URL retrieval used by sync_cloud_protection().
Restrict PHP execution within wp-content/uploads/ using web server configuration.
Enforce least-privilege registration policies and disable open user registration where not required.

bash

# Disable PHP execution in the WordPress uploads directory (Apache)
cat > /var/www/html/wp-content/uploads/.htaccess <<'EOF'
<FilesMatch "\.(php|phar|phtml)$">
    Require all denied
</FilesMatch>
EOF

# Disable remote URL fetching in php.ini
sed -i 's/^allow_url_fopen.*/allow_url_fopen = Off/' /etc/php/php.ini
systemctl reload php-fpm apache2