CVE-2026-5415: WP Captcha PRO <= 5.38 - Authenticated (Subscriber+) Authentication Bypass via Temporary Login Link

Synopsis

Authentication bypass in WP Captcha PRO (Advanced Google reCAPTCHA plugin for WordPress) versions up to and including 5.38 allows a low-privilege attacker to generate a passwordless login link for any WordPress user, including administrators. The vulnerability is reachable over the network and requires only a subscriber-level account; the nonce needed to trigger the flawed AJAX handler is leaked to all authenticated backend users on non-settings admin pages. Successful exploitation gives the attacker full control of any targeted account, including administrative accounts, resulting in complete site takeover. No fix version has been published; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable AJAX handler is exposed over the network via the WordPress HTTP endpoint, so the attacker must be able to reach the target WordPress installation over the internet or internal network.

• AuthenticationRequired

  A valid WordPress account at subscriber level or above is required; any low-privilege account that can access the admin backend is sufficient to obtain the exposed nonce and trigger the AJAX handler.

• Victim interactionNot required

  No victim action is needed; the attacker independently calls the AJAX handler and generates the passwordless login link without any user interaction.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and condition-free once the attacker holds a subscriber-level session and the plugin's welcome pointer has not been dismissed on the target site.

Blast Radius

• Attacker generates a passwordless login link for any WordPress user, including site administrators, and authenticates as that user without knowing their password.
• Full administrative access to the WordPress dashboard allows the attacker to read all stored content, user data, and credentials held in the site's database.
• With admin access, the attacker can install or modify plugins and themes, injecting arbitrary code into the site's PHP execution context.
• The attacker can create, modify, or delete posts, pages, users, and site configuration, causing persistent data tampering or full site defacement.