CVE-2026-5415

Name of the Vulnerable Software and Affected Versions WP Captcha PRO versions prior to 5.39

Description An authentication bypass exists due to the ajax run tool() AJAX handler relying only on a nonce check via check ajax referer() without performing capability checks. This is combined with the create temporary link tool, which allows the generation of passwordless login links for arbitrary users, and the handle temporary links() function, which authenticates visitors using these links without further authorization validation. The necessary nonce is exposed to all authenticated backend users, including those with Subscriber-level access, via wp localize script() on non-settings admin pages if the welcome pointer is not dismissed. This allows authenticated attackers to log in as any user, including Administrators, leading to complete account takeover.

Recommendations Update to a version later than 5.38.