WP Captcha PRO CVE-2026-5411: Brief Summary of Arbitrary File Upload to Remote Code Execution via Licensing Module

Introduction

WP Captcha PRO's licensing module is missing an authorization check. Any WordPress user with a Subscriber account can use it to inject a malicious URL into the plugin's configuration. The plugin then downloads and extracts a file from that URL without restriction, placing a PHP webshell directly into a web-accessible uploads directory. The underlying Advanced Google reCAPTCHA plugin, which shares its slug with the premium WP Captcha PRO, has 200,000+ active installations, so this CVSS 8.8 vulnerability is a significant remote code execution risk across a large part of the WordPress ecosystem.

WebFactory Ltd develops WP Captcha PRO as the premium version of the Advanced Google reCAPTCHA plugin. It adds CAPTCHA protection to WordPress login, registration, comment, and contact forms and integrates with Google reCAPTCHA v2/v3. The PRO tier adds features such as brute-force protection and cloud-based security. The free version alone has over 200,000 active installations, making it one of the more widely deployed CAPTCHA plugins for WordPress.

Technical Information

Root Cause: Two Flaws, One Chain

CVE-2026-5411 is classified under CWE-434: Unrestricted Upload of File with Dangerous Type. The CVSS v3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The attack runs over the network, has low complexity, needs only a low-privilege authenticated account and no user interaction, and has high impact on confidentiality, integrity, and availability.

The vulnerability is not a single missing check but a chain of two separate weaknesses in the plugin's licensing and cloud protection subsystem:

Flaw 1: Missing Authorization in save_ajax()

The save_ajax() function in the plugin's licensing module handles AJAX-based settings saves for the license configuration. In all versions up to and including 5.38, this function had an insufficient capability check, or none at all. WordPress capability checks are the standard way to verify whether a user has the permissions to perform an action. Without the check, any authenticated user, including one with the lowest default role of Subscriber, could call this AJAX action and write arbitrary values into the plugin's license metadata. The field that matters is cloud_protection_url, which controls where the plugin fetches its cloud protection archive.

Flaw 2: Unrestricted File Extraction in sync_cloud_protection()

The sync_cloud_protection() function downloads a ZIP archive from whatever URL is stored in the cloud_protection_url license meta field. In vulnerable versions, it did no file type validation on the archive contents. It extracted everything straight into a web-accessible WordPress uploads directory, with no allowlist of permitted extensions, no content type inspection, and no sanitization of the filenames inside the archive.

Attack Flow

An attacker exploiting CVE-2026-5411 follows this sequence:

1. Obtain Subscriber access: Register a new account on the target site if open registration is enabled, or use any existing authenticated account with Subscriber or higher privileges.

2. Inject malicious URL: Send an AJAX request to the save_ajax() endpoint, setting the cloud_protection_url license meta field to an attacker-controlled server. That server hosts a ZIP archive containing a PHP webshell.

3. Trigger cloud protection sync: Call the sync_cloud_protection() function, which reads the poisoned cloud_protection_url, downloads the ZIP archive from the attacker's server, and extracts its contents into the web-accessible uploads directory.

4. Execute the webshell: Request the extracted PHP file directly at the known uploads path (for example, https://target.com/wp-content/uploads/[path]/shell.php). The attacker now has remote code execution on the server with the privileges of the web server process.

Configuration Dependency

The remote exploitation path has one notable constraint: the PHP configuration directive allow_url_fopen must be enabled for sync_cloud_protection() to fetch files from a remote URL. This directive lets PHP's file functions, such as file_get_contents(), open remote URLs. It is enabled by default in many PHP configurations, so the remote path works on a large share of WordPress deployments.

When allow_url_fopen is disabled, the remote fetch fails. That does not fully remove the risk. If an attacker can place a malicious archive on the local filesystem through another vector, the extraction phase still runs without restriction.

Discovery and Disclosure

Security researcher h0xilo discovered the vulnerability and coordinated it through Wordfence's vulnerability disclosure program. NVD published the CVE on June 5, 2026. Wordfence served as the CNA (CVE Numbering Authority).

A companion vulnerability, CVE-2026-5415 (also CVSS 8.8), was disclosed the same day in the same plugin version. It is an authentication bypass via temporary login link. Both flaws come from missing authorization checks on AJAX actions available to low-privilege users, which points to a systemic gap in the plugin's access control.

Patch Information

The vendor fixed CVE-2026-5411 in WP Captcha PRO version 5.39, as confirmed by Wordfence, the CNA for this vulnerability. The Wordfence advisory states the remediation directly: "Update to version 5.39, or a newer patched version," with the affected range being all versions up to and including 5.38.

Version 5.39 fixes both links in the exploit chain:

• Capability and authorization checks were added to save_ajax(), so only users with appropriate administrative privileges can modify the license meta, including the cloud_protection_url field. This stops Subscriber-level users from changing the cloud protection configuration.

• File type validation was added to sync_cloud_protection() to block the extraction of dangerous file types, such as .php files, from downloaded archives. This is a second layer of defense if the authorization check were somehow bypassed.

The vendor's public changelog at getwpcaptcha.com/changelog/ has not been updated beyond 5.29 (dated March 2025), so there is no vendor-published release note documenting the security fix. Third-party distribution sites confirm that version 5.39 was published around April 19, 2026, before the public CVE disclosure on June 5, 2026. This points to a coordinated disclosure where the patch shipped quietly before the advisory went public.

The free version of the plugin, listed on WordPress.org as "Advanced Google reCAPTCHA," uses a separate version scheme (currently v1.35) and is not directly affected by this CVE, which targets the premium-only licensing module code path unique to WP Captcha PRO.

Interim Mitigations

If you cannot patch immediately, these measures reduce exposure:

Disable the plugin entirely. This removes the vulnerable AJAX endpoint. It also removes CAPTCHA protection from login, registration, and comment forms, so deploy alternative spam protection.

Set allow_url_fopen = Off in php.ini. This blocks the remote URL exploitation path, but it does not fix the missing authorization in save_ajax().

Restrict Subscriber account creation. Audit WordPress user accounts and restrict or remove Subscriber-level accounts. Add registration controls such as invitation-only signup or email verification.

Block PHP execution in the uploads directory. For Apache, add this to .htaccess in the uploads directory:

<Files *.php>
deny from all
</Files>

For Nginx:

location /wp-content/uploads/ {
    location ~ \.php$ {
        deny all;
    }
}

This does not prevent file upload, but it neutralizes the webshell execution path.

Deploy WAF rules. The Wordfence Premium, Care, and Response firewall includes a virtual patch for this vulnerability. Custom WAF rules can also block the vulnerable AJAX action for non-administrative users.

Affected Systems and Versions

• WP Captcha PRO: All versions up to and including 5.38. The first patched version is 5.39.
• Plugin slug: advanced-google-recaptcha (shared between the free Advanced Google reCAPTCHA and the premium WP Captcha PRO).
• WordPress requirement: 4.9 or higher.
• PHP requirement: 5.2 or higher.
• Configuration dependency: Remote exploitation requires allow_url_fopen to be enabled in php.ini (enabled by default in many PHP installations).
• Authentication requirement: Any authenticated WordPress user with Subscriber-level access or above.

The free version of Advanced Google reCAPTCHA (currently v1.35 on WordPress.org) is not directly affected by this CVE, because the vulnerable code path lives in the premium-only licensing module. Both versions share the same plugin slug, so verify which version is deployed across your WordPress fleet.

Vendor Security History

WebFactory Ltd has a documented pattern of security issues in the Advanced Google reCAPTCHA / WP Captcha PRO plugin family. CVE-2026-5411 is the fifth vulnerability disclosed in this plugin:

The trajectory is worth noting. The three earlier vulnerabilities were all medium severity (5.3) and affected the free version. The two most recent are both high severity (8.8) and affect the premium version. That suggests the PRO codebase, which adds the licensing and cloud protection features, has had less rigorous security review than the free version despite being a paid product.

The free version's changelog documents several security-related updates: version 1.30 (March 2025) included security fixes, version 1.28 (February 2025) improved math CAPTCHA security, and versions 1.23, 1.22, and 1.17 also included security patches. The plugin's FAQ directs security researchers to the Patchstack Vulnerability Disclosure Program, though CVE-2026-5411 was disclosed through Wordfence instead.

Threat Intelligence Context

As of June 5, 2026, there is no evidence of active exploitation of CVE-2026-5411. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog.

The broader threat landscape gives useful context for judging urgency:

• CVE-2026-8732 in WP Maps Pro, a closely analogous WordPress plugin vulnerability that let attackers create admin accounts, was actively exploited with 2,858 attacks within 24 hours of disclosure (reported June 1, 2026).
• The ShadowCaptcha campaign (August 2025) specifically targeted WordPress sites using CAPTCHA-related functionality, exploiting over 100 sites to spread ransomware, steal data, and mine cryptocurrency.
• VulnCheck's research found that 25 CVEs disclosed in 2026 have already been routinely targeted by adversaries and researchers.

Given the CVSS 8.8 score, the low authentication barrier, and the direct RCE outcome, CVE-2026-5411 fits the profile of vulnerabilities that move from disclosure to mass exploitation within days. The lack of current wild exploitation probably reflects how new the disclosure is rather than any real difficulty in weaponizing it.

References

• NVD: CVE-2026-5411
• Wordfence Advisory: WP Captcha PRO <= 5.38 Missing Authorization to Arbitrary File Upload
• CVE Feed: CVE-2026-5411
• WP Captcha PRO Official Site
• WP Captcha PRO Changelog
• Advanced Google reCAPTCHA on WordPress.org
• Wordfence: Advanced Google reCAPTCHA Vulnerability History
• WebFactory Ltd WordPress Profile
• The Hacker News: Critical WP Maps Pro Flaw Actively Exploited
• VulnCheck: Quantifying 2026 Routinely Targeted Vulnerabilities
• ShadowCaptcha Campaign Hijacks 100+ WordPress Sites
• CISA Known Exploited Vulnerabilities Catalog