hCaptcha for WP <= 5.4.1 - Unauthenticated CAPTCHA Bypass via WooCommerce Checkout
- ID
- WPSEC-2026-2314
- Plugin
- hCaptcha for WP (hcaptcha-for-forms-and-more)
- Affected
- from 4.24.0 before 5.5.0
- Remediation
- Update to 5.5.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-693
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-03
- Attack surface
- hCaptcha for WP on WPSec AttackSurface
- Fix released
- Published
Description
The hCaptcha for WP plugin for WordPress is vulnerable to a protection mechanism bypass via the WooCommerce checkout integration in versions 4.24.0 up to, and including, 5.4.1. This is due to the classic checkout skipping verification when the attacker-controlled 'wc-ajax' and 'path' query parameters matched the Payment Plugins for Stripe checkout route, and to both the classic and the Store API checkouts skipping verification when the submitted payment method was a Stripe gateway with banner (express) checkout enabled. This makes it possible for unauthenticated attackers to place orders, and create customer accounts through checkout, without solving the hCaptcha challenge the site owner enabled, for example to automate orders or card testing.
References
- https://wpsec.com/vuln/WPSEC-2026-2314/
- https://plugins.svn.wordpress.org/hcaptcha-for-forms-and-more/tags/5.5.0/
- https://wordpress.org/plugins/hcaptcha-for-forms-and-more/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS