hCaptcha for WP <= 5.4.1 - Unauthenticated CAPTCHA Bypass via GiveWP Donation Forms
- ID
- WPSEC-2026-2309
- Plugin
- hCaptcha for WP (hcaptcha-for-forms-and-more)
- Affected
- all versions before 5.5.0
- Remediation
- Update to 5.5.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-693
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-03
- Attack surface
- hCaptcha for WP on WPSec AttackSurface
- Fix released
- Published
Description
The hCaptcha for WP plugin for WordPress is vulnerable to a protection mechanism bypass via the GiveWP integration in all versions up to, and including, 5.4.1. This is due to the legacy donation form check running only when the POST 'action' value was 'give_process_donation', which is the AJAX validation request and not the final 'give_action=purchase' submission, and to the block (Form Builder) donation route being checked only when the 'givewp-route-signature-id' query parameter was 'givewp-donate'. This makes it possible for unauthenticated attackers to submit donations without solving the hCaptcha challenge, for example to automate card testing.
References
- https://wpsec.com/vuln/WPSEC-2026-2309/
- https://plugins.svn.wordpress.org/hcaptcha-for-forms-and-more/tags/5.5.0/
- https://wordpress.org/plugins/hcaptcha-for-forms-and-more/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS