Executive brief
WP Captcha PRO, a premium WordPress plugin used to protect websites from spam and brute-force attacks, contains a security flaw that allows authenticated users with low-level access (such as subscribers) to upload malicious files. By exploiting this vulnerability, an attacker can upload a web shell to the server, granting them the ability to execute commands and take full control of the website. This could lead to the theft of customer data, site defacement, or a total service outage.
Technical details
The WP Captcha PRO plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check in the save_ajax() function within the licensing module, paired with unrestricted file extraction in the sync_cloud_protection() function. Authenticated attackers with Subscriber-level permissions or higher can inject a malicious URL into the 'cloud_protection_url' license meta. The plugin subsequently downloads the content from this URL and extracts it into a web-accessible directory without validating the file types. If the PHP configuration 'allow_url_fopen' is enabled, this allows for the upload of PHP scripts, leading to Remote Code Execution (RCE). The vulnerability affects all versions up to and including 5.38.
Affected products
- WP Captcha WP Captcha PRO (Advanced Google reCAPTCHA) Up to, and including, 5.38
Timeline
- 2026-06-05: disclosed
- 2026-06-05: advisory