CVE-2026-5411

Name of the Vulnerable Software and Affected Versions WP Captcha PRO versions prior to 5.39

Description The plugin is susceptible to arbitrary file upload, which can lead to remote code execution. The issue stems from a flawed capability check in the save ajax() function within the licensing module, paired with unrestricted file extraction in the sync cloud protection() function. Authenticated attackers with Subscriber-level access or higher can inject a malicious cloud protection url into the license meta. The plugin then downloads and extracts the content from this URL into a web-accessible uploads directory without validating the file type, allowing the upload of PHP webshells. This exploitation requires the allow url fopen setting to be enabled in the php.ini configuration.

Recommendations Update the plugin to a version later than 5.38. As a temporary mitigation, disable the allow url fopen setting in the php.ini configuration to prevent the download of remote malicious files.