CVE-2026-85117 in Contact Form 7 Captcha Plugin
Summary
by MITRE • 09/09/2026
The Contact Form 7 Captcha WordPress plugin before 0.1.9 runs the shortcode parser over the whole rendered Contact Form 7 form, including the values a visitor submitted, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified in versions of the Contact Form 7 Captcha plugin prior to release 0.1.9 represents a critical server-side code injection flaw rooted in improper input validation and processing logic within the WordPress ecosystem. This specific weakness allows unauthenticated attackers to execute arbitrary shortcodes registered on the target website, effectively bypassing standard authentication mechanisms that would typically restrict such actions to authorized administrators or editors. The core of this issue lies in how the plugin handles data submitted through contact forms, specifically failing to distinguish between static form structure and dynamic user input during the rendering process.
The technical flaw originates from the plugin's decision to run the WordPress shortcode parser over the entire rendered Contact Form 7 output, which inadvertently includes values entered by visitors into form fields. In a secure implementation, user-supplied data should be treated as plain text or strictly sanitized before any processing occurs. However, because this plugin processes the submitted values through the same parsing engine used for static content, it allows attackers to inject shortcode syntax directly into input fields such as name, email, or message boxes. When the form is processed and rendered again, often during error handling or re-display after submission failures, these injected shortcodes are interpreted by WordPress rather than displayed as literal text.
This behavior aligns with Common Weakness Enumeration (CWE) category CWE-94, which describes Improper Control of Generation of Code (Code Injection). By leveraging this injection vector, an attacker can manipulate the server-side execution flow without needing valid credentials. The operational impact is severe because WordPress shortcodes are powerful tools that often trigger complex backend functions, database queries, or API calls depending on their registration and configuration by theme developers or other plugins. An unauthenticated user exploiting this flaw could potentially access sensitive data, modify site content, escalate privileges to administrative levels if specific dangerous shortcodes are present, or cause denial of service conditions through resource-intensive shortcode execution.
The attack vector is particularly insidious because it does not require complex exploitation techniques or specialized tools beyond a standard web browser and knowledge of the target's registered shortcodes. It falls under MITRE ATT&CK technique T1059, Command and Scripting Interpreter, specifically within the context of server-side script execution via injection. The lack of authentication requirement makes this vulnerability highly exploitable in automated scanning campaigns targeting WordPress installations that use both Contact Form 7 and its captcha add-on. Attackers can systematically probe for exposed shortcodes by submitting payloads containing various shortcode tags to see if they are executed, thereby mapping out the capabilities available on the compromised site.
Mitigation strategies must prioritize immediate patching of the affected plugin version to ensure that input validation is correctly implemented before any parsing occurs. Developers should enforce strict whitelisting or sanitization of user inputs so that special characters and shortcode delimiters like square brackets are escaped or removed prior to being passed through the rendering engine. Additionally, implementing Content Security Policy headers can help mitigate some downstream effects by restricting script execution contexts, although this does not fix the root cause. Site administrators should also audit their active plugins for any custom shortcodes that might be vulnerable to such injection and consider disabling unnecessary shortcode functionality where possible to reduce the attack surface available to potential exploiters until the patch is applied.