CVE-2026-5415 is an authentication bypass vulnerability in the WP Captcha PRO plugin for WordPress, affecting versions up to 5.38. The issue arises because the ajax_run_tool() AJAX handler relies solely on a nonce check without verifying user capabilities. The create_temporary_link tool can generate passwordless login links for any user, and handle_temporary_links() authenticates visitors via these links without additional authorization. The required nonce is exposed to all authenticated backend users, including low-privilege Subscribers, via wp_localize_script() on non-settings admin pages when the plugin's welcome pointer is active. This allows an attacker with Subscriber-level access to bypass normal authentication and log in as any user, including administrators, leading to full account takeover.

An attacker with authenticated Subscriber-level access or higher can bypass authentication controls and gain administrative access to the WordPress site. This results in complete compromise of user accounts and potentially the entire site, including the ability to modify content, install malicious code, or disrupt service. The vulnerability has a CVSS 3.1 score of 8.8, indicating high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — no official fix or remediation guidance is currently available from the vendor. Until a patch is released, restrict access to authenticated users with Subscriber-level permissions and consider disabling or removing the WP Captcha PRO plugin if possible. Monitor vendor advisories for updates and apply official patches promptly once available.