CVE-2026-5411Disclosure

LOWCVSS 8.8 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

The WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug) plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 5.38. This is due to a capability check in the save_ajax() function of the licensing module, combined with unrestricted file extraction in sync_cloud_protection(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files including PHP webshells to the server by injecting a malicious cloud_protection_url into the license meta, which the plugin then downloads and extracts without file type validation into a web-accessible uploads directory. This can be used for remote code execution. Note: The vulnerability can only be exploited with a remote URL if "allow_url_fopen" is enabled in the php.ini config.

Back to dashboard

1.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-434

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Threat summary

Public PoC is present in monitored signal
3 mentions across 2 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Technical details provided in 3 signals
Disclosure: 2 classified signals
Peaked 1d ago at 2 mentions (2026-06-06); latest day: 1
3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d

Signal classification2 categories

Disclosure

266.7%

PoC

133.3%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-06	2	Disclosure2
2026-06-14	1	PoC1

Full discourse3 posts

Atomic Edge@atomicedgeWAF128d
PoC
https://atomicedge.io/cve-proof/cve-2026-5411-advanced-google-recaptcha-version-5-38-high-vulnerability-proof-of-concept CVE-2026-5411 advanced-google-recaptcha (CVSS Score 8.8) #WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wps…
Post summary
The post shares a proof‑of‑concept for CVE‑2026‑5411, including CVSS score and target details, but does not mention an active exploit, patch, or false‑positive claim.
0000059
9 followersView on X
CVE@CVEnew136d
Disclosure
CVE-2026-5411 The WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug) plugin for WordPress is vulnerable to arbitrary file upload in… https://www.cve.org/CVERecord?id=CVE-2026-5411
Post summary
The text announces a vulnerability in the WP Captcha PRO plugin for WordPress, identified as CVE-2026-5411, and links to the official CVE record.
00000183
57.6K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds136d
Disclosure
CVE-2026-5411 Arbitrary File Upload and Remote Code Execution in WP Captcha PRO Up to 5.38 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-5411
Post summary
The note announces CVE-2026-5411 as an arbitrary file upload and remote code execution issue in WP Captcha PRO up to version 5.38, linking to a vulnerability details page but providing no PoC, exploitation code, or patch information.
0000045
4.0K followersView on X

Explore more

Back to dashboard