Executive brief
WP Captcha PRO, a WordPress plugin used to protect websites from spam and brute-force attacks, contains a security flaw that allows users with low-level accounts (like Subscribers) to log in as any other user. By exploiting this, an attacker can gain full administrative control over the website. This could lead to the theft of sensitive customer data, complete site defacement, or the installation of malicious software.
Technical details
The WP Captcha PRO plugin for WordPress is vulnerable to an authentication bypass in versions up to 5.38 due to a lack of capability checks in the 'ajax_run_tool()' AJAX handler. While the handler uses a nonce for security, the nonce is exposed to all authenticated users via 'wp_localize_script()' on admin pages. An attacker with Subscriber-level access can use this nonce to trigger the 'create_temporary_link' tool, generating a passwordless login link for any user account. The 'handle_temporary_links()' function then authenticates the visitor using these links without further authorization validation, leading to full account takeover.
Affected products
- WP Captcha WP Captcha PRO up to, and including, 5.38
Timeline
- 2026-06-05: disclosed
- 2026-06-05: advisory