CVE-2026-5411

A security flaw exists within WP Captcha PRO, a premium WordPress plugin, affecting versions up to 5.38. Specifically, a licensing module vulnerability allows users with Subscriber-level access or higher to bypass security checks and upload arbitrary files, including malicious PHP scripts, by manipulating the cloud_protection_url in their license metadata. This can lead to remote code execution on the server, provided "allow_url_fopen" is enabled in the php.ini configuration.

Based on public CVE data (MITRE/NVD).