CVE-2026-5415 is an authentication bypass vulnerability in the WP Captcha PRO plugin (Advanced Google reCAPTCHA) for WordPress affecting versions up to 5.38. The ajax_run_tool() AJAX handler relies solely on a nonce check without verifying user capabilities. The create_temporary_link tool can generate passwordless login links for arbitrary users, and handle_temporary_links() authenticates visitors via these links without additional authorization. The nonce required for these actions is exposed to all authenticated backend users, including Subscribers, via wp_localize_script() on non-settings admin pages when the plugin's welcome pointer is active. This allows low-privileged authenticated users to bypass normal authentication and log in as any user, including administrators, resulting in complete account takeover.

An attacker with Subscriber-level access or higher can bypass authentication controls to log in as any user, including administrators. This leads to full account takeover, compromising confidentiality, integrity, and availability of the affected WordPress site. The CVSS score of 8.8 reflects the high severity and ease of exploitation given the low privileges required and no user interaction needed.

No official patch or fix is currently confirmed for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is available, restrict backend user roles to trusted individuals only and consider disabling or removing the WP Captcha PRO plugin if possible. Avoid dismissing the plugin's welcome pointer to prevent nonce exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.