→ برگشت به فید آسیب‌پذیری‌ها CVE-2026-103347 · hcaptcha-for-forms-and-more

دور زدن محدودیت‌های امنیتی (Security Bypass) در افزونه hCaptcha for WP

The hCaptcha for WP plugin for WordPress is vulnerable to Bypass Vulnerability in all versions up to, and including, 5.3.0. This is due to form action registrations stored exclusively in a WordPress transient that could expire or be evicted, causing get_registered_form() to return null and skip the hCaptcha requirement for auto-verified forms. This makes it possible for unauthenticated attackers to bypass hCaptcha verification on auto-verified forms by waiting for or triggering transient expiration, causing the plugin to skip the captcha check entirely. The site must use AutoVerify (auto-detected hCaptcha integration) for at least one form.