# hCaptcha for WP <= 5.4.1 - Unauthenticated CAPTCHA Bypass via WooCommerce Checkout

- **ID:** WPSEC-2026-2314
- **Plugin:** hCaptcha for WP (`hcaptcha-for-forms-and-more`), https://wordpress.org/plugins/hcaptcha-for-forms-and-more/
- **Affected versions:** from 4.24.0 before 5.5.0
- **Fixed in:** 5.5.0 (Update to 5.5.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-693
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/hcaptcha-for-forms-and-more
- **Fix released:** 2026-10-30
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2314/

## Description

The hCaptcha for WP plugin for WordPress is vulnerable to a protection mechanism bypass via the WooCommerce checkout integration in versions 4.24.0 up to, and including, 5.4.1. This is due to the classic checkout skipping verification when the attacker-controlled 'wc-ajax' and 'path' query parameters matched the Payment Plugins for Stripe checkout route, and to both the classic and the Store API checkouts skipping verification when the submitted payment method was a Stripe gateway with banner (express) checkout enabled. This makes it possible for unauthenticated attackers to place orders, and create customer accounts through checkout, without solving the hCaptcha challenge the site owner enabled, for example to automate orders or card testing.

## References

- https://wpsec.com/vuln/WPSEC-2026-2314/
- https://plugins.svn.wordpress.org/hcaptcha-for-forms-and-more/tags/5.5.0/
- https://wordpress.org/plugins/hcaptcha-for-forms-and-more/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2314/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.