hCaptcha for WP <= 5.3.0 - Unauthenticated hCaptcha Bypass via LearnPress Checkout Account Creation
- ID
- WPSEC-2026-0019
- Plugin
- hCaptcha for WP (hcaptcha-for-forms-and-more)
- Affected
- from 4.9.0 before 5.4.0
- Remediation
- Update to 5.4.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-693
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- hCaptcha for WP on WPSec AttackSurface
- Fix released
- Published
Description
The hCaptcha for WP plugin for WordPress is vulnerable to a protection mechanism bypass in versions 4.9.0 up to, and including, 5.3.0. The LearnPress checkout integration verified hCaptcha on the learn-press/validate-checkout-fields hook. Current LearnPress fires that hook only after it has already registered the new customer account submitted with the checkout form, and the callback's three-argument signature did not match the single argument LearnPress passes, so it failed with an error after the account already existed. This makes it possible for unauthenticated attackers to create user accounts through the LearnPress checkout without solving the hCaptcha challenge. Exploitation requires the LearnPress checkout integration, open user registration and a LearnPress version that fires the hook after account creation.
References
- https://wpsec.com/vuln/WPSEC-2026-0019/
- https://plugins.svn.wordpress.org/hcaptcha-for-forms-and-more/tags/5.4.0/
- https://wordpress.org/plugins/hcaptcha-for-forms-and-more/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS