CVE-2026-5411

The WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug) plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 5.38. This is due to a capability check in the save_ajax() function of the licensing module, combined with unrestricted file extraction in sync_cloud_protection(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files including PHP webshells to the server by injecting a malicious cloud_protection_url into the license meta, which the plugin then downloads and extracts without file type validation into a web-accessible uploads directory. This can be used for remote code execution. Note: The vulnerability can only be exploited with a remote URL if "allow_url_fopen" is enabled in the php.ini config.

• CWE-434

• https://getwpcaptcha.com
• https://www.wordfence.com/threat-intel/vulnerabilities/id/92652339-ec86-4069-aeee-91c314ed2540?source=cve

Published

Jun 5, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54104The U.S. Government Accountability Office (GAO) Electronic P…8.8
• CVE-2026-54105The U.S. Government Accountability Office (GAO) Electronic P…6.9
• CVE-2026-54106The U.S. Government Accountability Office (GAO) Electronic P…5.1
• CVE-2026-54107Concurrent execution using shared resource with improper syn…7
• CVE-2026-54108External control of file name or path in Microsoft Office Sh…6.5
• CVE-2026-54109Integer overflow or wraparound in Windows Resilient File Sys…7.8
• CVE-2026-54111Concurrent execution using shared resource with improper syn…7
• CVE-2026-54112Concurrent execution using shared resource with improper syn…7
• CVE-2026-54113Allocation of resources without limits or throttling in Wind…7.5
• CVE-2026-54114Use after free in Windows Win32K allows an authorized attack…7.8
• CVE-2026-54115Integer overflow or wraparound in Windows Active Directory a…7.8
• CVE-2026-54116Access of resource using incompatible type ('type confusion'…6.5