hCaptcha for WP <= 5.3.0 - Unauthenticated Denial of Service via Unbounded Failed Login Data
- ID
- WPSEC-2026-0020
- Plugin
- hCaptcha for WP (hcaptcha-for-forms-and-more)
- Affected
- from 2.4.0 before 5.4.0
- Remediation
- Update to 5.4.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- Weakness
- CWE-770
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- hCaptcha for WP on WPSec AttackSurface
- Fix released
- Published
Description
The hCaptcha for WP plugin for WordPress is vulnerable to uncontrolled resource consumption in versions 2.4.0 up to, and including, 5.3.0. Every failed login added the client IP address as a key in the single hcaptcha_login_data option, and only expired timestamps were pruned, never the address keys, so the option grew without limit. The whole option is read on every request where a login integration is enabled and rewritten on every failed login. This makes it possible for unauthenticated attackers who send failed logins from many source addresses (for example, by rotating IPv6 addresses) to bloat the option and degrade site performance.
References
- https://wpsec.com/vuln/WPSEC-2026-0020/
- https://plugins.svn.wordpress.org/hcaptcha-for-forms-and-more/tags/5.4.0/
- https://wordpress.org/plugins/hcaptcha-for-forms-and-more/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS