This vulnerability (CWE-290) in hCaptcha for WP versions <= 5.3.0 enables an attacker to bypass authentication controls by spoofing. The CVSS 3.1 base score is 5.3 (medium severity), with network attack vector, low attack complexity, no privileges required, no user interaction, and an impact limited to integrity. No confidentiality or availability impacts are noted. No known exploits are reported in the wild, and no vendor advisory or patch information is provided in the input data.

The vulnerability allows an unauthenticated attacker to bypass authentication, potentially compromising the integrity of the system or data. There is no impact on confidentiality or availability according to the CVSS vector. No active exploitation is known at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates and consider additional access controls or compensating controls to mitigate spoofing risks until a fix is available.