hCaptcha for WP < 5.4.0 - Unauthenticated Captcha Verification Bypass

Description

The plugin is vulnerable to an hCaptcha verification bypass due to form action registrations being stored exclusively in a WordPress transient that could expire or be evicted, causing get_registered_form() to return null and skip the hCaptcha requirement for auto-verified forms. This makes it possible for unauthenticated attackers to bypass hCaptcha verification on auto-verified forms by waiting for or triggering transient expiration, causing the plugin to skip the captcha check entirely. The site must use AutoVerify (auto-detected hCaptcha integration) for at least one form.