CVE-2026-5411: WP Captcha PRO <= 5.38 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload

Synopsis

Missing authorization combined with unrestricted file extraction in WP Captcha PRO (also distributed as Advanced Google reCAPTCHA) for WordPress allows an authenticated attacker with Subscriber-level access to upload arbitrary files, including PHP webshells, to the server. The vulnerability is reachable over the network and requires no elevated privileges beyond a basic WordPress account. Successful exploitation gives the attacker remote code execution on the host. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable save_ajax() endpoint is exposed over the network, so an attacker must be able to reach the WordPress instance via HTTP or HTTPS.

• AuthenticationRequired

  A valid WordPress account at Subscriber level or above is sufficient; no administrative or elevated role is needed.

• Victim interactionNot required

  The attacker interacts directly with the plugin endpoint; no user action or social engineering is required.

• Attack complexityDetail

  The exploit is reliable and condition-free under standard CVSS scoring, though the remote URL injection path does require allow_url_fopen to be enabled in php.ini on the target server.

Blast Radius

• The attacker uploads a PHP webshell to a web-accessible uploads directory and executes arbitrary operating system commands on the server.
• Full read access to all data the web server process can reach, including WordPress database credentials, environment variables, and stored user data.
• Full write access to the filesystem paths accessible to the web server, enabling modification or deletion of application files and persisted content.
• The attacker can use the compromised server as a pivot point for lateral movement or further attacks within the same network segment.