The WP Captcha PRO plugin, the premium version of the Advanced Google reCAPTCHA plugin, permits an authenticated attacker with Subscriber level or higher to perform arbitrary file uploads. The vulnerability originates from a missing capability check in the licensing module’s save_ajax() function combined with unrestricted extraction in sync_cloud_protection(). An attacker can inject a malicious cloud_protection_url in the license meta, causing the plugin to download and extract the payload into a web‑accessible uploads directory without validating the file type. This allows the placement of PHP webshells, enabling remote code execution. The flaw is categorized as CWE‑434 (Unrestricted Upload of File with Dangerous Type) and can only be exploited when PHP’s allow_url_fopen setting is enabled.

The affected product is the Advanced Google reCAPTCHA plugin (WP Captcha PRO) for WordPress. All versions up to and including 5.38 are vulnerable. The plugin can be found on the official website https://getwpcaptcha.com and is distributed under the webfactory:Advanced Google reCAPTCHA vendor designation.

The vulnerability carries a CVSS score of 8.8, indicating high severity. EPSS data is not available, and the issue is not listed in the CISA KEV catalog. Exploitation requires a network‐accessible WordPress installation with a logged‐in user of Subscriber level or higher and the server configuration must allow remote URL requests (allow_url_fopen = On). Once the file is uploaded, the attacker can execute arbitrary PHP code, potentially compromising the entire server and data.