hCaptcha for WP <= 5.3.0 - Unauthenticated hCaptcha Bypass via Expired or Evicted Auto-Verification Registration
- ID
- WPSEC-2026-0021
- Plugin
- hCaptcha for WP (hcaptcha-for-forms-and-more)
- Affected
- from 1.11.0 before 5.4.0
- Remediation
- Update to 5.4.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-693
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- hCaptcha for WP on WPSec AttackSurface
- Fix released
- Published
Description
The hCaptcha for WP plugin for WordPress is vulnerable to a protection mechanism bypass in versions 1.11.0 up to, and including, 5.3.0. Forms protected with the auto-verify shortcode option ([hcaptcha auto="true"]) were verified only while their registration existed in a single transient. The transient expires one nonce lifetime (one day by default) after the last render of any auto-verified form, and from 5.2.0 it drops its least recently used entries once it exceeds 512 KB. A POST to a form whose registration had expired or been evicted was accepted without hCaptcha verification. This makes it possible for unauthenticated attackers to submit such forms without solving the challenge, for example after the registry expires on a low-traffic site, or after flooding it with registrations from an auto-verified form that has no action attribute and renders on attacker-chosen URLs.
References
- https://wpsec.com/vuln/WPSEC-2026-0021/
- https://plugins.svn.wordpress.org/hcaptcha-for-forms-and-more/tags/5.4.0/
- https://wordpress.org/plugins/hcaptcha-for-forms-and-more/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS