{
 "id": "WPSEC-2026-2309",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2309/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2309/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2309/index.md",
 "title": "hCaptcha for WP <= 5.4.1 - Unauthenticated CAPTCHA Bypass via GiveWP Donation Forms",
 "description": "The hCaptcha for WP plugin for WordPress is vulnerable to a protection mechanism bypass via the GiveWP integration in all versions up to, and including, 5.4.1. This is due to the legacy donation form check running only when the POST 'action' value was 'give_process_donation', which is the AJAX validation request and not the final 'give_action=purchase' submission, and to the block (Form Builder) donation route being checked only when the 'givewp-route-signature-id' query parameter was 'givewp-donate'. This makes it possible for unauthenticated attackers to submit donations without solving the hCaptcha challenge, for example to automate card testing.",
 "plugin": {
  "slug": "hcaptcha-for-forms-and-more",
  "name": "hCaptcha for WP",
  "full_name": "hCaptcha for WP",
  "wordpress_org": "https://wordpress.org/plugins/hcaptcha-for-forms-and-more/",
  "advisories_url": "https://wpsec.com/vuln/plugin/hcaptcha-for-forms-and-more/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/hcaptcha-for-forms-and-more"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-693"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.5.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.5.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.5.0",
 "remediation": "Update to 5.5.0 or later.",
 "fix_released": "2026-10-30T14:21:57+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:38:53.736396+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2309/",
  "https://plugins.svn.wordpress.org/hcaptcha-for-forms-and-more/tags/5.5.0/",
  "https://wordpress.org/plugins/hcaptcha-for-forms-and-more/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/hcaptcha-for-forms-and-more",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-03"
 }
}