CVE-2026-5415: WP Captcha PRO Auth Bypass Vulnerability

CVE-2026-5415 Overview

CVE-2026-5415 is an authentication bypass vulnerability in the WP Captcha PRO plugin for WordPress, the premium version of the Advanced Google reCAPTCHA plugin. All versions up to and including 5.38 are affected. The flaw resides in the ajax_run_tool() AJAX handler, which relies only on a nonce check without any capability validation. Authenticated attackers with Subscriber-level access can invoke the create_temporary_link tool to generate passwordless login links for arbitrary users, including Administrators. The handle_temporary_links() function then authenticates visitors using those links without further authorization checks, enabling complete account takeover [CWE-288].

Critical Impact

Any authenticated Subscriber can mint a passwordless login link for an Administrator account and seize full control of the WordPress site.

Affected Products

• WP Captcha PRO plugin for WordPress, all versions through 5.38
• Advanced Google reCAPTCHA plugin (shares the same slug as WP Captcha PRO), all versions through 5.38
• Any WordPress site permitting Subscriber-level registration with the affected plugin installed

Discovery Timeline

• 2026-06-05 - CVE-2026-5415 published to NVD
• 2026-06-05 - Last updated in NVD database

Technical Details for CVE-2026-5415

Vulnerability Analysis

The vulnerability stems from the ajax_run_tool() AJAX handler exposed by the WP Captcha PRO plugin. The handler protects itself with check_ajax_referer() but never verifies the caller's WordPress capabilities. Any authenticated user who possesses the nonce can therefore invoke privileged tools through the endpoint.

One such tool, create_temporary_link, generates a passwordless login link that can target any user ID supplied by the caller. The companion handle_temporary_links() function consumes these links and authenticates the visitor as the linked user with no additional authorization validation. The chain converts a low-privilege session into an Administrator session in a single request.

The required nonce is broadly available. The plugin calls wp_localize_script() on all non-settings admin pages whenever the welcome pointer has not been dismissed, exposing the nonce to every authenticated backend user, including Subscribers. Subscriber accounts can be created through default WordPress registration flows, making the exploit reachable on many production sites.

Root Cause

The root cause is missing authorization on a privileged AJAX action [CWE-288]. WordPress nonces are designed to prevent cross-site request forgery, not to enforce access control. Treating check_ajax_referer() as an authorization gate, combined with a tool that mints login links for arbitrary users, produces a direct privilege escalation path.

Attack Vector

An attacker registers or controls a Subscriber account on the target site. After logging in, the attacker loads any non-settings admin page to harvest the localized nonce. The attacker then issues an authenticated AJAX request to ajax_run_tool() with the create_temporary_link tool and a target user ID belonging to an Administrator. The returned URL, when visited, triggers handle_temporary_links() and authenticates the attacker as the Administrator, granting full site control.

No verified public exploit code is available. See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-5415

Indicators of Compromise

• POST requests to admin-ajax.php with action=ajax_run_tool originating from Subscriber or Contributor accounts.
• Requests whose payload references the create_temporary_link tool or includes a target user_id belonging to an Administrator.
• Successful authentication events for Administrator accounts that immediately follow a low-privilege session from the same IP or user agent.
• Unexpected sessions, password resets, plugin installations, or user role changes performed by Administrators outside normal working windows.

Detection Strategies

• Inspect web server and WordPress audit logs for admin-ajax.php traffic referencing ajax_run_tool from non-administrative roles.
• Correlate Subscriber logins with subsequent Administrator activity from matching client fingerprints.
• Alert on creation of temporary login URLs or auto-login token parameters in inbound query strings.

Monitoring Recommendations

• Enable WordPress login and role-change auditing through a security plugin or SIEM forwarder.
• Forward web access logs to a centralized analytics platform and build queries around the ajax_run_tool action name.
• Monitor for Subscriber account registrations that occur shortly before Administrator privilege use.

How to Mitigate CVE-2026-5415

Immediate Actions Required

• Update WP Captcha PRO or Advanced Google reCAPTCHA to a version newer than 5.38 as soon as the vendor releases a fix.
• Disable the plugin on sites that cannot be patched immediately, particularly those allowing open user registration.
• Audit Administrator accounts, active sessions, and recently created users, and rotate Administrator credentials and application passwords.
• Restrict new user registration or require manual approval until the plugin is patched.

Patch Information

No fixed version is identified in the published advisory. Refer to the vendor at getwpcaptcha.com and the Wordfence Vulnerability Report for current patch availability. Apply updates through the WordPress plugin manager once a release addressing ajax_run_tool() authorization is available.

Workarounds

• Deactivate and remove the WP Captcha PRO and Advanced Google reCAPTCHA plugins until a patched version ships.
• Block requests to admin-ajax.php containing action=ajax_run_tool at the web application firewall for non-administrator sessions.
• Set users_can_register to false in WordPress general settings to prevent unauthenticated Subscriber creation.
• Enforce strong multi-factor authentication on all Administrator accounts so a hijacked session cannot be repurposed without the second factor.

# Example WAF rule to block exploitation attempts
# Reject ajax_run_tool invocations from non-admin sessions
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
    "chain,phase:2,deny,status:403,id:1026541501,msg:'Block WP Captcha PRO ajax_run_tool (CVE-2026-5415)'"
    SecRule ARGS:action "@streq ajax_run_tool" \
        "chain"
        SecRule ARGS:tool "@streq create_temporary_link"