hCaptcha for WP EUVD-2026-90846

Requires a WordPress site running the hCaptcha for WP plugin (hcaptcha-for-forms-and-more) at version 5.3.0 or earlier, with hCaptcha protection actually enabled on one or more forms (login, registration, comment, WooCommerce, or contact forms). Exploitation is remote and unauthenticated (PR:N/UI:N) against such a configuration with no additional prerequisites. The practical impact is limited to defeating the anti-bot/captcha gate - it does not by itself compromise data or the site; its severity depends on what the protected forms expose and whether hCaptcha is the only mitigation in place. If the plugin is installed but captcha is not active on any endpoint, there is nothing to bypass.

This is a protection-mechanism bypass (CWE-290, Authentication Bypass by Spoofing) in the hCaptcha for WP plugin, rated CVSS 5.3 by Patchstack. The supplied vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N is internally consistent and credible: network-reachable, low-complexity, no privileges, no user interaction, with a single low-integrity impact (C:N/A:N). The integrity-only, low-magnitude impact is correct because the flaw does not grant data access or code execution - it lets an unauthenticated actor circumvent the hCaptcha challenge that is supposed to gate form submissions, re-enabling the automated abuse (spam, credential stuffing, brute force) the plugin exists to stop. No EPSS score, CISA KEV listing, or public POC is present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the real-world urgency is therefore moderate and driven by how the protected forms are used rather than by any direct compromise. This is a genuine but limited issue - not a high-CVSS-low-risk mislabel, but also not a critical priority: its practical severity is amplified only where hCaptcha is the sole defense protecting a sensitive endpoint (e.g. a login form), in which case the bypass removes rate-limiting/anti-bot friction for a secondary attack.

An unauthenticated attacker identifies a WordPress site running hCaptcha for WP (<= 5.3.0) and crafts form-submission requests that satisfy the plugin's verification logic without solving a real hCaptcha challenge, defeating the bot protection. They then script automated submissions against protected login, registration, comment, or contact forms to conduct spam, account enumeration, or credential-stuffing at scale. No public exploit code is identified in the provided data.