{
 "id": "WPSEC-2026-2314",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2314/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2314/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2314/index.md",
 "title": "hCaptcha for WP <= 5.4.1 - Unauthenticated CAPTCHA Bypass via WooCommerce Checkout",
 "description": "The hCaptcha for WP plugin for WordPress is vulnerable to a protection mechanism bypass via the WooCommerce checkout integration in versions 4.24.0 up to, and including, 5.4.1. This is due to the classic checkout skipping verification when the attacker-controlled 'wc-ajax' and 'path' query parameters matched the Payment Plugins for Stripe checkout route, and to both the classic and the Store API checkouts skipping verification when the submitted payment method was a Stripe gateway with banner (express) checkout enabled. This makes it possible for unauthenticated attackers to place orders, and create customer accounts through checkout, without solving the hCaptcha challenge the site owner enabled, for example to automate orders or card testing.",
 "plugin": {
  "slug": "hcaptcha-for-forms-and-more",
  "name": "hCaptcha for WP",
  "full_name": "hCaptcha for WP",
  "wordpress_org": "https://wordpress.org/plugins/hcaptcha-for-forms-and-more/",
  "advisories_url": "https://wpsec.com/vuln/plugin/hcaptcha-for-forms-and-more/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/hcaptcha-for-forms-and-more"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-693"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "4.24.0",
    "from_inclusive": true,
    "to": "5.5.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 4.24.0 before 5.5.0"
  ]
 },
 "introduced_in": "4.24.0",
 "fixed_in": "5.5.0",
 "remediation": "Update to 5.5.0 or later.",
 "fix_released": "2026-10-30T14:21:57+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:38:53.736396+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2314/",
  "https://plugins.svn.wordpress.org/hcaptcha-for-forms-and-more/tags/5.5.0/",
  "https://wordpress.org/plugins/hcaptcha-for-forms-and-more/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/hcaptcha-for-forms-and-more",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-03"
 }
}