The hCaptcha for WP plugin contains a missing authorization flaw (CWE‑862) that permits attackers to perform actions they are not authorized to execute. By bypassing proper permission checks before processing certain plugin operations, an attacker could view or modify protected resources within the WordPress site, potentially compromising its configuration and user data.

Versions of the hCaptcha for WP plugin from the earliest available release through 4.21.1 are affected. Any WordPress installation that includes one of these plugin versions is susceptible, particularly if a user account has permission to access the plugin’s settings or form configuration pages.

With a CVSS score of 5.3 the vulnerability is classified as moderate. The EPSS score is below 1 %, indicating a very low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is through the WordPress administration interface that manages hCaptcha settings or forms; this inference is not explicitly stated in the CVE description. Based on the description, it is inferred that ownership of a user account with at least plugin‑configuration privileges is required to exploit the flaw, and no additional software is necessary beyond the standard WordPress environment.