{
 "id": "WPSEC-2026-2310",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2310/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2310/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2310/index.md",
 "title": "hCaptcha for WP <= 5.4.1 - Unauthenticated CAPTCHA Bypass via wpDiscuz Comment Action Parameter",
 "description": "The hCaptcha for WP plugin for WordPress is vulnerable to a protection mechanism bypass via the wpDiscuz comment integration in all versions up to, and including, 5.4.1. This is due to the comment check running only when $_POST['action'] was 'wpdAddComment', while admin-ajax.php dispatches on $_REQUEST['action'], so the wpDiscuz handler still runs when the action is sent in the query string. This makes it possible for unauthenticated attackers to post wpDiscuz comments without solving the hCaptcha challenge.",
 "plugin": {
  "slug": "hcaptcha-for-forms-and-more",
  "name": "hCaptcha for WP",
  "full_name": "hCaptcha for WP",
  "wordpress_org": "https://wordpress.org/plugins/hcaptcha-for-forms-and-more/",
  "advisories_url": "https://wpsec.com/vuln/plugin/hcaptcha-for-forms-and-more/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/hcaptcha-for-forms-and-more"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-693"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.5.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.5.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.5.0",
 "remediation": "Update to 5.5.0 or later.",
 "fix_released": "2026-10-30T14:21:57+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:38:53.736396+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2310/",
  "https://plugins.svn.wordpress.org/hcaptcha-for-forms-and-more/tags/5.5.0/",
  "https://wordpress.org/plugins/hcaptcha-for-forms-and-more/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/hcaptcha-for-forms-and-more",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-03"
 }
}