CVE-2026-5411 is a vulnerability in the WP Captcha PRO plugin (Advanced Google reCAPTCHA) for WordPress, affecting all versions up to 5.38. The issue arises from a capability check flaw in the save_ajax() licensing function combined with unrestricted file extraction in sync_cloud_protection(). Authenticated attackers with Subscriber-level privileges can inject a malicious cloud_protection_url into the license meta, causing the plugin to download and extract arbitrary files without validating file types into a web-accessible uploads directory. If PHP's allow_url_fopen is enabled, this can be exploited remotely to upload PHP webshells, enabling remote code execution.

An attacker with at least Subscriber-level access can upload arbitrary files, including executable PHP webshells, to the server. This can lead to full remote code execution, compromising confidentiality, integrity, and availability of the affected system. The vulnerability requires allow_url_fopen to be enabled for remote URL exploitation. The CVSS v3.1 score is 8.8, indicating high severity with network attack vector, low attack complexity, and no user interaction required.

No official patch or fix has been confirmed as of the published date. Users should check the vendor advisory for updates. Until a fix is available, consider disabling allow_url_fopen in php.ini to prevent remote URL exploitation. Restricting plugin access to trusted users and monitoring for suspicious uploads may reduce risk. Avoid using versions up to and including 5.38 where possible.