CVE-2026-103347 Overview
CVE-2026-103347 is an unauthenticated bypass vulnerability affecting the hCaptcha for WP WordPress plugin in versions 5.3.0 and earlier. The flaw is classified under [CWE-290] (Authentication Bypass by Spoofing) and allows remote attackers to circumvent the hCaptcha challenge without supplying valid verification. The issue is network-exploitable, requires no authentication, and no user interaction. Because hCaptcha is deployed to block automated form submissions, a bypass undermines protections against spam, credential stuffing, and brute-force attacks against WordPress forms protected by the plugin.
Critical Impact
Unauthenticated remote attackers can bypass hCaptcha verification on WordPress sites using hCaptcha for WP <= 5.3.0, enabling automated abuse of protected forms.
Affected Products
- hCaptcha for WP (WordPress plugin, hcaptcha-for-forms-and-more)
- All versions <= 5.3.0
- WordPress sites relying on this plugin for form protection
Discovery Timeline
- 2026-10-01 - CVE-2026-103347 published to NVD
- 2026-10-01 - Last updated in NVD database
Technical Details for CVE-2026-103347
Vulnerability Analysis
The vulnerability resides in the verification logic of the hCaptcha for WP plugin. hCaptcha is intended to validate that a form submission originated from a human by requiring the client to solve a challenge and return a verifiable token. The plugin should then validate that token server-side with hCaptcha before accepting the submission.
In versions <= 5.3.0, an attacker can craft requests that satisfy the plugin's acceptance path without providing a valid, verified token. The weakness maps to [CWE-290], where the authentication-equivalent check is spoofed or trivially skipped. The result is that automated clients can submit forms as if they had passed the challenge.
Root Cause
The root cause is improper validation of the hCaptcha verification response within the plugin's request-handling flow. Specific technical mechanics are described in the Patchstack HCaptcha Bypass Vulnerability advisory. The plugin treats certain request states as valid without enforcing a successful server-side verification against the hCaptcha API.
Attack Vector
An unauthenticated attacker sends crafted HTTP requests to any WordPress form protected by hCaptcha for WP. By manipulating the submission payload to avoid or satisfy the flawed check, the attacker reaches the downstream form handler as if a valid challenge response was supplied. This enables automated submission of login forms, registration forms, comment forms, and contact forms at scale.
// No verified exploit code is published. See the Patchstack advisory for technical details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-103347
Indicators of Compromise
- Spikes in successful form submissions without corresponding hCaptcha widget loads in web server logs.
- Form submissions with missing, malformed, or repeated h-captcha-response parameters that are nonetheless accepted.
- Elevated POST volume to WordPress endpoints such as wp-login.php, wp-comments-post.php, or plugin-registered form handlers from a narrow set of source IPs or user agents.
Detection Strategies
- Correlate requests to protected form endpoints against prior GETs that load hCaptcha assets from hcaptcha.com to identify sessions that submit without rendering a challenge.
- Enable WordPress audit logging to track registration, comment, and login attempts and flag bursts that exceed historical baselines.
- Compare the running plugin version to 5.3.0 across all managed WordPress installations and treat any match or lower as vulnerable.
Monitoring Recommendations
- Monitor Web Application Firewall (WAF) logs for anomalous POST patterns against hCaptcha-protected forms.
- Alert on surges in new user registrations, failed logins, or spam comments following the publication date.
- Track outbound verification calls from the WordPress host to hcaptcha.com/siteverify and alert when form acceptance rates diverge from verification success rates.
How to Mitigate CVE-2026-103347
Immediate Actions Required
- Inventory all WordPress sites running the hcaptcha-for-forms-and-more plugin and identify instances at version 5.3.0 or earlier.
- Upgrade affected sites to a fixed release above 5.3.0 as published by the plugin maintainer.
- Review logs since the publication date for signs of automated abuse of protected forms and reset credentials for any accounts created or accessed via affected flows.
Patch Information
Refer to the Patchstack HCaptcha Bypass Vulnerability advisory for the current patched version and release notes. Apply the vendor-supplied update through the WordPress plugin manager or by deploying the updated plugin package via your configuration management pipeline.
Workarounds
- Temporarily disable the hCaptcha for WP plugin on exposed forms if an immediate upgrade is not feasible, and substitute an alternative anti-automation control.
- Add WAF rules that reject form submissions missing a well-formed h-captcha-response parameter and rate-limit submissions per source IP.
- Restrict access to high-value forms such as registration and login behind additional controls like IP allowlists or multi-factor authentication where applicable.
# Example: identify the installed hCaptcha for WP plugin version using WP-CLI
wp plugin get hcaptcha-for-forms-and-more --field=version
# Example: update the plugin to the latest fixed release
wp plugin update hcaptcha-for-forms-and-more
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
