WP Captcha PRO < 5.39 - Subscriber+ Authentication Bypass via Temporary Login Link

Description

The plugin is vulnerable to an authentication bypass due to the `ajax_run_tool()` AJAX handler relying solely on a nonce check (`check_ajax_referer`) without performing any capability check, combined with the `create_temporary_link` tool allowing the generation of passwordless login links for arbitrary users, and the `handle_temporary_links()` function authenticating visitors via these links without any additional authorization validation. The required nonce is exposed to all authenticated backend users (including Subscribers) via `wp_localize_script()` on all non-settings admin pages when the plugin's welcome pointer has not been dismissed. This makes it possible for authenticated attackers with Subscriber-level access and above to bypass normal authentication and log in as any user, including Administrators, resulting in complete account takeover.

Note: WP Captcha PRO is the premium build of the Advanced Google reCAPTCHA plugin and shares the same `advanced-google-recaptcha` slug.