WordPress Plugin Flaws Enable Account Takeover and Possible RCE

Multiple high-severity flaws in WordPress plugins exposed sites to account takeover and, in one case, possible remote code execution. In Users Manager PN, tracked as CVE-2026-4003, a missing authorization check in the userspn_ajax_nopriv_server() handler let unauthenticated attackers overwrite arbitrary user metadata through the userspn_form_save AJAX action. Because the required userspn-nonce was reportedly exposed on public pages, attackers could abuse the bug with a single crafted request to modify profiles and potentially seize control of administrator accounts. The issue affected versions through 1.1.15 and was reportedly fixed in 1.1.20.

Two additional vulnerabilities were disclosed in WP Captcha PRO affecting versions through 5.38. CVE-2026-5415 allowed Subscriber-level users or higher to generate temporary login links for arbitrary accounts because the ajax_run_tool() AJAX handler checked only a nonce and not user capabilities, enabling authentication bypass and administrator takeover. Separately, CVE-2026-5411 allowed authenticated low-privilege users to upload attacker-controlled files by poisoning license metadata and abusing sync_cloud_protection() to download and extract content into a web-accessible uploads directory; if PHP execution was possible and allow_url_fopen was enabled for remote retrieval, the flaw could be escalated to remote code execution via a webshell.