The vulnerability identified as CVE-2026-25315 affects the hCaptcha for WP plugin, specifically versions up to 4.21.1. It is caused by missing authorization checks, leading to incorrect access control configurations. This allows an attacker to potentially access resources or functionality without proper permissions. The CVSS 3.1 base score is 5.3, with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to confidentiality loss. No integrity or availability impacts are noted. The vulnerability was published on 2026-02-19, with no patch or exploit information available at this time.

The vulnerability allows unauthorized access due to missing authorization controls, which may lead to limited confidentiality loss. There is no evidence of impact on data integrity or system availability. No known exploits have been reported in the wild, suggesting limited or no active exploitation currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and restrict access permissions related to the hCaptcha for WP plugin where possible. Monitor vendor channels for updates and apply patches promptly once released.