# hCaptcha for WP <= 5.4.1 - Unauthenticated CAPTCHA Bypass via GiveWP Donation Forms

- **ID:** WPSEC-2026-2309
- **Plugin:** hCaptcha for WP (`hcaptcha-for-forms-and-more`), https://wordpress.org/plugins/hcaptcha-for-forms-and-more/
- **Affected versions:** all versions before 5.5.0
- **Fixed in:** 5.5.0 (Update to 5.5.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-693
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/hcaptcha-for-forms-and-more
- **Fix released:** 2026-10-30
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2309/

## Description

The hCaptcha for WP plugin for WordPress is vulnerable to a protection mechanism bypass via the GiveWP integration in all versions up to, and including, 5.4.1. This is due to the legacy donation form check running only when the POST 'action' value was 'give_process_donation', which is the AJAX validation request and not the final 'give_action=purchase' submission, and to the block (Form Builder) donation route being checked only when the 'givewp-route-signature-id' query parameter was 'givewp-donate'. This makes it possible for unauthenticated attackers to submit donations without solving the hCaptcha challenge, for example to automate card testing.

## References

- https://wpsec.com/vuln/WPSEC-2026-2309/
- https://plugins.svn.wordpress.org/hcaptcha-for-forms-and-more/tags/5.5.0/
- https://wordpress.org/plugins/hcaptcha-for-forms-and-more/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2309/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.