Introduction
A security plugin built to protect WordPress login forms just introduced a way to bypass authentication entirely. CVE-2026-5415 is an authentication bypass in WP Captcha PRO, the premium version of the Advanced Google reCAPTCHA plugin. It lets any user with a Subscriber account generate a passwordless login link for any other user on the site, including Administrators.
WP Captcha PRO, developed by WebFactory Ltd, is the premium tier of the Advanced Google reCAPTCHA plugin, which reports over 200,000 active installations on WordPress.org. The plugin adds CAPTCHA integration to WordPress login, registration, and comment forms, and supports multiple CAPTCHA types including Google reCAPTCHA v2. Both the free and premium versions share the same WordPress plugin slug (advanced-google-recaptcha), so they share code paths and potentially vulnerable components. A CAPTCHA and login security plugin introducing an authentication bypass is not an irony we expected to write up.
Technical Information
Root Cause Analysis
CVE-2026-5415 is classified under CWE-288 (Authentication Bypass Using an Alternate Path or Channel) and carries a CVSS 3.1 base score of 8.8 High with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The score reflects a network exploitable vulnerability that needs only low privileges (Subscriber role), no user interaction, and results in high impact across confidentiality, integrity, and availability. Wordfence assigned this score. The NVD has listed the analysis status as "Not Scheduled" because of resource constraints and has not yet provided an independent assessment.
The vulnerability is not a single bug but a chain of three design weaknesses that, combined, produce a complete authentication bypass.
1. Missing Capability Check in ajax_run_tool()
The ajax_run_tool() AJAX handler uses check_ajax_referer() as its only security gate. This function verifies a WordPress nonce, a mechanism designed to prevent Cross-Site Request Forgery (CSRF). Nonce verification is not an authorization mechanism. WordPress nonces confirm that a request came from a legitimate page load within a recent time window. They do not verify that the requesting user has the role or capabilities to perform the requested action. The handler runs no current_user_can() check, so any authenticated user who holds a valid nonce can invoke any tool the handler exposes, whether they are a Subscriber or an Administrator.
2. Nonce Exposure via wp_localize_script()
The nonce needed to call ajax_run_tool() is embedded in JavaScript output through wp_localize_script(). This exposure happens on all non-settings admin pages whenever the plugin's welcome pointer has not been dismissed. The welcome pointer is a one-time dismissible UI element that many administrators may never touch, so the nonce stays broadly accessible. Any authenticated user who can reach /wp-admin/, including Subscribers (the lowest WordPress role), gets the nonce in the page's JavaScript payload.
3. Passwordless Temporary Login Link Generation Without Authorization
The create_temporary_link tool, reachable through the unprotected ajax_run_tool() handler, generates passwordless login links for arbitrary user accounts. The handle_temporary_links() function then processes incoming requests that use these links and authenticates the visitor without any additional authorization validation. There is no check that the temporary link was generated by an authorized user, no expiration enforcement beyond the link's existence, and no restriction on which target accounts can receive temporary links.
Attack Flow
A realistic exploitation scenario runs through these steps:
-
Obtain Subscriber Access: The attacker registers a Subscriber account on the target WordPress site (if open registration is enabled) or compromises an existing low-privilege account.
-
Extract the Nonce: The attacker logs into the WordPress dashboard and opens any non-settings admin page (such as
/wp-admin/index.php). If the plugin's welcome pointer has not been dismissed, the page's JavaScript includes the AJAX nonce embedded throughwp_localize_script(). The attacker reads this nonce from the page source or browser developer tools. -
Generate a Temporary Login Link: Using the extracted nonce, the attacker crafts an AJAX request to
ajax_run_tool(), naming thecreate_temporary_linktool and supplying the target user ID. On most WordPress installations, user ID 1 is the initial Administrator account. The handler validates the nonce throughcheck_ajax_referer(), which succeeds, and generates a passwordless login URL for the specified user. -
Authenticate as the Target User: The attacker opens the generated temporary login URL. The
handle_temporary_links()function processes the request and authenticates the attacker as the target user without a password or any further validation. -
Complete Account Takeover: The attacker now has full Administrator access to the WordPress site, which enables arbitrary plugin installation, theme modification, user management, database access, and any other action available to the Administrator role.
Why This Matters
Several things make this vulnerability especially concerning:
- Minimal Privilege Requirement: Subscriber is the lowest WordPress role, often available through open registration.
- No User Interaction: The victim does not need to click a link, visit a page, or do anything.
- Low Complexity: The attack needs only standard WordPress AJAX interaction. No specialized tools or deep technical knowledge are required.
- Full Impact: The attacker gains complete Administrator privileges, which in WordPress means unrestricted control over the site, its database, and its file system.
The CVSS vector confirms this: Attack Vector is Network, Attack Complexity is Low, Privileges Required is Low, and User Interaction is None, with High impact across all three CIA triad dimensions.
Patch Information
WebFactory Ltd released a patch in WP Captcha PRO version 5.39. The Wordfence advisory, published on June 5, 2026, marks the vulnerability as "Patched: Yes" and names version 5.39 as the remediation target.
The patch addresses the three interlocking flaws that enabled the authentication bypass:
Capability Check Addition: Version 5.39 is expected to enforce a proper current_user_can() capability check (for example, requiring manage_options or an equivalent administrator-level capability) in the ajax_run_tool() handler before it runs privileged tool actions. This is the core fix: even if a low-privilege user holds a valid nonce, they are denied access to sensitive tools like create_temporary_link.
Restricted Temporary Link Generation: The patch restricts access to the create_temporary_link tool so that only users with appropriate privileges can generate temporary login links. This stops Subscribers from crafting links that grant them Administrator sessions.
Authorization in handle_temporary_links(): Version 5.39 is expected to add authorization checks in the handle_temporary_links() function, validating that temporary login requests came from a legitimately authorized workflow.
Nonce Exposure Scope: The core fix is the addition of capability checks, but the patch may also limit nonce exposure through wp_localize_script() to only the pages and roles where it is needed, which reduces the attack surface further.
Because WP Captcha PRO is a premium (closed-source) plugin distributed through getwpcaptcha.com, no public code diff or commit history is available. Administrators should update to version 5.39 or later through their plugin dashboard or the vendor's distribution channel.
Interim Mitigations
For environments where immediate patching is not possible, these measures reduce exposure:
| Mitigation | Effectiveness | Notes |
|---|---|---|
| Update to version 5.39 | Complete | Addresses root cause |
| Dismiss the welcome pointer | Partial | Blocks nonce exposure path |
| Restrict Subscriber dashboard access | Partial | Prevents nonce extraction |
| Wordfence Premium/Care/Response firewall rule | Protective | Blocks exploit traffic |
| Disable open user registration | Preventive | Limits attacker access to Subscriber accounts |
| Monitor AJAX calls to ajax_run_tool | Detective | Alerts on exploitation attempts |
Dismissing the plugin's welcome pointer removes the nonce exposure condition and breaks one link in the exploit chain. Keeping Subscriber-level users out of /wp-admin/ stops them from reaching the pages where the nonce is embedded. Wordfence Premium, Care, and Response users received a firewall rule that protects against exploits targeting this vulnerability. The free Wordfence tier does not include this rule.
None of these interim measures replace patching. The update to version 5.39 is the only complete remediation.
Affected Systems and Versions
- WP Captcha PRO: All versions up to and including 5.38
- Advanced Google reCAPTCHA (free version): Shares the same plugin slug (
advanced-google-recaptcha) and may share affected code paths. Verify both free and premium installations. - Patched Version: 5.39
- WordPress Role Requirement: Subscriber or above (any authenticated user with dashboard access)
- Conditional Exposure: The nonce is exposed only when the plugin's welcome pointer has not been dismissed. Sites where the pointer has been dismissed have a reduced, but not eliminated, attack surface.
The free version on WordPress.org reports 200,000+ active installations. The premium version's installation count is not publicly disclosed, but it shares the same codebase.
Vendor Security History
WebFactory Ltd's Advanced Google reCAPTCHA and WP Captcha PRO plugins have a documented history of security vulnerabilities:
| CVE / Vulnerability | Affected Versions | Severity | Description |
|---|---|---|---|
| CVE-2026-5415 | WP Captcha PRO <= 5.38 | 8.8 High | Authentication Bypass via Temporary Login Link |
| Arbitrary File Upload | WP Captcha PRO <= 5.38 | Not yet scored | Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload |
| CVE-2025-1262 | Advanced Google reCAPTCHA <= 1.27 | 5.0 Medium | Guessable CAPTCHA bypass |
| IP Unblock Vulnerability | Advanced Google reCAPTCHA <= 1.25 | Not yet scored | Brute Force Protection IP Unblock |
Two high-impact vulnerabilities turned up at the same time in WP Captcha PRO version 5.38, both from missing authorization and capability checks. That points to a systemic pattern rather than an isolated coding error. The ajax_run_tool() handler's reliance on nonce-only security looks like a recurring design flaw in the plugin's AJAX architecture. Organizations using this plugin should weigh whether its security posture matches their risk tolerance, especially since a security-focused plugin that introduces authentication bypass vulnerabilities is a real trust concern.
References
- NVD: CVE-2026-5415
- Wordfence Advisory: WP Captcha PRO <= 5.38 Authentication Bypass via Temporary Login Link
- Wordfence: WP Captcha PRO <= 5.38 Authentication Bypass (Plugin Page)
- Wordfence: WP Captcha PRO <= 5.38 Arbitrary File Upload
- CVEFeed: CVE-2026-5415
- WP Captcha PRO Vendor Site
- Advanced Google reCAPTCHA on WordPress.org
- WebFactory WordPress.org Profile
- Rapid7: CVE-2025-1262 (Advanced Google reCAPTCHA)
- Wordfence: Advanced Google reCAPTCHA <= 1.25 IP Unblock
- GitHub Advisory: GHSA-m8p9-q5r3-wrmf
- CISA Known Exploited Vulnerabilities Catalog
- VulnCheck: Routinely Targeted Vulnerabilities (May 2026)
- Bitdefender: Threat Actors Exploit High-Severity Bypass Vulnerability in WordPress Plugin
