CVE-2026-2374: Login No Captcha reCAPTCHA <= 1.8.0 - Unauthenticated Stored Cross-Site Scripting via PHP_SELF

Synopsis

Stored cross-site scripting (XSS) in the Login No Captcha reCAPTCHA plugin for WordPress (versions up to and including 1.8.0) allows an unauthenticated remote attacker to inject arbitrary JavaScript into the WordPress admin dashboard. The plugin's authenticate() function writes the unsanitized value of basename($_SERVER['PHP_SELF']) into a WordPress option on any login attempt against a non-standard endpoint such as xmlrpc.php; the admin_notices() function then echoes that stored value directly into dashboard HTML without escaping. When an administrator visits the dashboard within roughly 30 seconds of the attack, the injected script executes in their browser session. No fix versions have been published; HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WordPress login or xmlrpc.php endpoint over the network to submit a crafted login request that plants the malicious value.

• AuthenticationNot required

  No account or credentials are needed; the injection is triggered by an unauthenticated login attempt against the target endpoint.

• Victim interactionRequired

  A WordPress administrator must visit the dashboard after the malicious value has been stored, causing their browser to execute the injected script.

• Attack complexityDetail

  The exploit is reliable and condition-free once the target endpoint is reachable, though the attacker must time the attack so an administrator loads the dashboard within the approximately 30-second window before the stored value is overwritten or expires.

Blast Radius

• An attacker whose script runs in the administrator's browser session can read the session cookie or auth tokens and replay them to take over the admin account.
• The injected script can create new administrator-level WordPress accounts or modify existing user credentials, giving the attacker persistent access to the site.
• Arbitrary content, including redirects or malware download prompts, can be injected into pages served to end users of the WordPress site.