WP Captcha PRO versions up to 5.38 contain a vulnerability that allows an attacker with subscriber‑level access to bypass normal WordPress authentication and become any user, including administrators. The flaw arises because the ajax_run_tool() handler relies only on a nonce check and the temporary link feature creates passwordless login links for any user. The necessary nonce is exposed through wp_localize_script() on all non‑settings admin pages when the welcome pointer has not been dismissed, so a legitimate subscriber can send a crafted AJAX request and obtain a temporary link that logs them in as the target account. Once logged in, the attacker gains full control of that account’s privileges and can perform any action allowed to the target user.

The affected product is the WP Captcha PRO (Advanced Google reCAPTCHA) plugin for WordPress, version 5.38 or earlier. Only installations running the premium plugin under that version name are impacted.

The vulnerability scores a CVSS of 8.8, indicating a high severity. While EPSS is not available, the lack of a KEV listing means it has not been identified as a widely exploited vulnerability by CISA, though the high score suggests it could be targeted. The attack requires legitimate subscriber access, so it is limited to authenticated users who have not dismissed the plugin’s welcome pointer. Once the attacker calls the vulnerable AJAX endpoint, no additional authorization checks are performed, enabling a straight account takeover with no need for further exploitation steps.