Vulnerabilities / hCaptcha for WP / WPSEC-2026-2310
hCaptcha for WP <= 5.4.1 - Unauthenticated CAPTCHA Bypass via wpDiscuz Comment Action Parameter
Medium 5.3
CWE-693Fixed in 5.5.0
- ID
- WPSEC-2026-2310
- Plugin
- hCaptcha for WP (hcaptcha-for-forms-and-more)
- Affected
- all versions before 5.5.0
- Remediation
- Update to 5.5.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-693
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-03
- Attack surface
- hCaptcha for WP on WPSec AttackSurface
- Fix released
- Published
Description
The hCaptcha for WP plugin for WordPress is vulnerable to a protection mechanism bypass via the wpDiscuz comment integration in all versions up to, and including, 5.4.1. This is due to the comment check running only when $_POST['action'] was 'wpdAddComment', while admin-ajax.php dispatches on $_REQUEST['action'], so the wpDiscuz handler still runs when the action is sent in the query string. This makes it possible for unauthenticated attackers to post wpDiscuz comments without solving the hCaptcha challenge.
References
- https://wpsec.com/vuln/WPSEC-2026-2310/
- https://plugins.svn.wordpress.org/hcaptcha-for-forms-and-more/tags/5.5.0/
- https://wordpress.org/plugins/hcaptcha-for-forms-and-more/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS