CVE-2026-25315

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25315", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-02-02T12:20:47.810Z", "datePublished": "2026-02-19T08:26:54.349Z", "dateUpdated": "2026-04-28T16:14:54.794Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "hcaptcha-for-forms-and-more", "product": "hCaptcha for WP", "vendor": "hcaptcha", "versions": [{"changes": [{"at": "4.22.0", "status": "unaffected"}], "lessThanOrEqual": "4.21.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "dragonzen | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-01T16:05:03.039Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in hcaptcha hCaptcha for WP hcaptcha-for-forms-and-more allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects hCaptcha for WP: from n/a through <= 4.21.1.</p>"}], "value": "Missing Authorization vulnerability in hcaptcha hCaptcha for WP hcaptcha-for-forms-and-more allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects hCaptcha for WP: from n/a through <= 4.21.1."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:14:54.794Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/hcaptcha-for-forms-and-more/vulnerability/wordpress-hcaptcha-for-wp-plugin-4-22-0-broken-access-control-vulnerability?_s_id=cve"}], "title": "WordPress hCaptcha for WP plugin <= 4.21.1 - Broken Access Control vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-20T16:31:20.722831Z", "id": "CVE-2026-25315", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-28T12:55:28.784Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25315", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-20T16:31:20.722831Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-20T16:26:14.176Z"}}], "cna": {"title": "WordPress hCaptcha for WP plugin <= 4.21.1 - Broken Access Control vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "dragonzen | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "hcaptcha", "product": "hCaptcha for WP", "versions": [{"status": "affected", "changes": [{"at": "4.22.0", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "4.21.1"}], "packageName": "hcaptcha-for-forms-and-more", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-04-28T13:26:39.601Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/hcaptcha-for-forms-and-more/vulnerability/wordpress-hcaptcha-for-wp-plugin-4-22-0-broken-access-control-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in hcaptcha hCaptcha for WP hcaptcha-for-forms-and-more allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects hCaptcha for WP: from n/a through <= 4.21.1.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in hcaptcha hCaptcha for WP hcaptcha-for-forms-and-more allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects hCaptcha for WP: from n/a through <= 4.21.1.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T12:10:48.835Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25315", "state": "PUBLISHED", "dateUpdated": "2026-04-28T12:55:28.784Z", "dateReserved": "2026-02-02T12:20:47.810Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-02-19T08:26:54.349Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "hcaptcha-for-forms-and-more", "product": "hCaptcha for WP", "vendor": "hcaptcha", "versions": [{"changes": [{"at": "4.22.0", "status": "unaffected"}], "lessThanOrEqual": "4.21.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "audit@patchstack.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in hcaptcha hCaptcha for WP hcaptcha-for-forms-and-more allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects hCaptcha for WP: from n/a through <= 4.21.1."}, {"lang": "es", "value": "Vulnerabilidad por falta de autorizaci\u00f3n en hcaptcha hCaptcha para WP hcaptcha-for-forms-and-more permite la explotaci\u00f3n de niveles de seguridad de control de acceso mal configurados. Este problema afecta a hCaptcha para WP: desde n/a hasta &lt;= 4.22.0."}], "id": "CVE-2026-25315", "lastModified": "2026-06-17T10:24:24.610", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "audit@patchstack.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25315", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-20T16:31:20.722831Z", "version": "2.0.3"}}]}, "published": "2026-02-19T09:16:15.773", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/hcaptcha-for-forms-and-more/vulnerability/wordpress-hcaptcha-for-wp-plugin-4-22-0-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.22.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "hCaptcha for WP", "source": "cna", "vendor": "hcaptcha"}, "product": "hcaptcha_for_wp", "vendor": "hcaptcha"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-16T16:59:59.726937+00:00", "value": {"mitigation_remediation": ["Upgrade the hCaptcha for WP plugin to version\u202f4.22.0 or later.", "Restrict WordPress user roles that can access the plugin\u2019s configuration screens, ensuring only administrators have permission to alter hCaptcha settings.", "Audit server and WordPress logs for anomalous plugin activity and investigate any suspicious changes."], "summary": {"action": "Patch", "impact": "Unauthorized Access"}, "threat_synthesis": {"affected_systems": "Versions of the hCaptcha for WP plugin from the earliest available release through 4.21.1 are affected. Any WordPress installation that includes one of these plugin versions is susceptible, particularly if a user account has permission to access the plugin\u2019s settings or form configuration pages.", "description_and_impact": "The hCaptcha for WP plugin contains a missing authorization flaw (CWE\u2011862) that permits attackers to perform actions they are not authorized to execute. By bypassing proper permission checks before processing certain plugin operations, an attacker could view or modify protected resources within the WordPress site, potentially compromising its configuration and user data.", "risk_and_exploitability": "With a CVSS score of 5.3 the vulnerability is classified as moderate. The EPSS score is below 1\u202f%, indicating a very low likelihood of exploitation, and the vulnerability is not listed in CISA\u2019s KEV catalog. The likely attack vector is through the WordPress administration interface that manages hCaptcha settings or forms; this inference is not explicitly stated in the CVE description. Based on the description, it is inferred that ownership of a user account with at least plugin\u2011configuration privileges is required to exploit the flaw, and no additional software is necessary beyond the standard WordPress environment."}}}}, "created": "2026-02-20T10:09:07.345793+00:00", "updated": "2026-04-16T17:00:09.399155+00:00", "vendors": ["hcaptcha", "hcaptcha$PRODUCT$hcaptcha_for_wp", "wordpress", "wordpress$PRODUCT$wordpress"]}