The vulnerability is limited to the CAPTCHA mechanism intended to protect a publicly accessible form from automated abuse. It does not impact WordPress-level authentication or authorization controls.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| KAGG | hCaptcha for WP | unaffected |
|
No data.
No data.
| Vendor | Product | Confidence | Versions |
|---|---|---|---|
| Hcaptcha | Hcaptcha For Wp | — | — |
| Wordpress | Wordpress | — | — |
Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .
Vendor Solution
Update the WordPress hCaptcha for WP plugin to the latest available version (at least 4.22.0).
Tracking
Sign in to view the affected projects.
No advisories yet.
Mon, 30 Mar 2026 08:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-862 | |
| References |
|
Mon, 30 Mar 2026 08:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Missing Authorization vulnerability in hcaptcha hCaptcha for WP hcaptcha-for-forms-and-more allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects hCaptcha for WP: from n/a through <= 4.22.0. | Improperly implemented security check vulnerability in KAGG hCaptcha for WP allows CAPTCHA Functionality Bypass.This issue affects hCaptcha for WP: from n/a through 4.21.1. The vulnerability is limited to the CAPTCHA mechanism intended to protect a publicly accessible form from automated abuse. It does not impact WordPress-level authentication or authorization controls. |
| Title | WordPress hCaptcha for WP plugin <= 4.22.0 - Broken Access Control vulnerability | WordPress hCaptcha for WP plugin <= 4.21.1 - Access Control (CAPCTHA) bypass vulnerability |
| Weaknesses | CWE-358 | |
| References |
|
Fri, 20 Feb 2026 17:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
Fri, 20 Feb 2026 10:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Hcaptcha
Hcaptcha hcaptcha For Wp Wordpress Wordpress wordpress |
|
| Vendors & Products |
Hcaptcha
Hcaptcha hcaptcha For Wp Wordpress Wordpress wordpress |
Thu, 19 Feb 2026 08:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Missing Authorization vulnerability in hcaptcha hCaptcha for WP hcaptcha-for-forms-and-more allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects hCaptcha for WP: from n/a through <= 4.22.0. | |
| Title | WordPress hCaptcha for WP plugin <= 4.22.0 - Broken Access Control vulnerability | |
| Weaknesses | CWE-862 | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: Patchstack
Published:
Updated: 2026-03-30T07:38:32.814Z
Reserved: 2026-02-02T12:20:47.810Z
Link: CVE-2026-25315
Vulnrichment
Updated: 2026-02-20T16:26:14.176Z
NVD
Status : Awaiting Analysis
Published: 2026-02-19T09:16:15.773
Modified: 2026-03-30T08:16:16.573
Link: CVE-2026-25315
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-02-20T10:09:07Z