medium6.5
CVE-2026-85117
The Contact Form 7 Captcha WordPress plugin before 0.1.9 runs the shortcode parser over the whole rendered Contact Form 7 form, including the values a visitor …
Impact
The Contact Form 7 Captcha WordPress plugin before 0.1.9 runs the shortcode parser over the whole rendered Contact Form 7 form, including the values a visitor submitted, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.
Affected products
| Product | Affected versions |
|---|---|
| Contact Form 7 Captcha WordPress Plugin | before 0.1.9 |
Versions were read from the advisory text. No structured product data has been published for this record yet.