CVE Explorer
CVE-2026-5415
The WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug) plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.38. This is due to the ajax_run_tool() AJAX handler relying solely on a nonce check (check_ajax_referer) for security without performing any capability check, combined with the create_temporary_link tool allowing the generation of passwordless login links for arbitrary users, and the handle_te
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"defaultStatus":"unaffected","product":"Advanced Google reCAPTCHA","vendor":"webfactory","versions":[{"lessThanOrEqual":"5.38","status":"affected","version":"0","versionType":"semver"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:3d74ac4db75418832912320563f8d1e21e2d4ae0afe04357c69c9c275c9685f6 · sha256:f15f9d89587eca34… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:3d74ac4db75418832912320563f8d1e21e2d4ae0afe04357c69c9c275c9685f6 · sha256:f15f9d89587eca34… · /containers/cna/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-288","description":"CWE-288 Authentication Bypass Using an Alternate Path or Channel","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:3d74ac4db75418832912320563f8d1e21e2d4ae0afe04357c69c9c275c9685f6 · sha256:f15f9d89587eca34… · /containers/cna/problemTypes/0/descriptions/0
Source references
2 source assertions{"url":"https://getwpcaptcha.com"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:3d74ac4db75418832912320563f8d1e21e2d4ae0afe04357c69c9c275c9685f6 · sha256:f15f9d89587eca34… · /containers/cna/references/1
{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8731565f-4d8a-49e6-9c38-6d4f5e51d68c?source=cve"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:3d74ac4db75418832912320563f8d1e21e2d4ae0afe04357c69c9c275c9685f6 · sha256:f15f9d89587eca34… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.