CVE-2026-2374

Vulnerability

The Login No Captcha reCAPTCHA plugin for WordPress versions up to and including 1.8.0 contains a stored cross-site scripting vulnerability in the authenticate() function. When a login attempt is made from a non-standard login page (e.g., xmlrpc.php), the function stores the unsanitized output of basename($_SERVER['PHP_SELF']) into the login_nocaptcha_error WordPress option. The admin_notices() function then echoes this stored value directly into the admin dashboard HTML without escaping [1][2][3][4].

Exploitation

An unauthenticated attacker can trigger the vulnerability by making a login request to a non-standard login page such as xmlrpc.php with a crafted PHP_SELF value containing malicious JavaScript. The attacker does not need authentication or any special network position beyond being able to send HTTP requests to the WordPress site. The malicious payload is stored in the login_nocaptcha_error option and will be executed when an administrator with a whitelisted IP address visits the WordPress dashboard within 30 seconds of the attack [1].

Impact

Successful exploitation allows the attacker to inject arbitrary web scripts into the admin dashboard. This can lead to session hijacking, credential theft, or further compromise of the WordPress site. The attack requires the administrator to have a whitelisted IP address (as configured in the plugin) and to visit the dashboard within the 30-second window, but no other user interaction is needed [1].

Mitigation

As of the publication date (2026-05-28), no fixed version has been released. Users should disable the plugin until a patch is available. The vulnerability is not listed in the CISA KEV as of this writing. Administrators can temporarily remove the whitelist IP feature or restrict access to non-standard login pages as a workaround [1].