Image CAPTCHA for Contact Form 7 and WPForms through 3.3.29 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat the anti-automation control by exploiting a hardcoded static answer in the Contact Form 7 integration. Attackers can submit kc_captcha=kc_human to pass validation in cf7ic_check_if_spam() on every protected form, enabling automated contact-form spam and abuse of actions gated only by this CAPTCHA.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Thu, 12 Nov 2026 20:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Image CAPTCHA for Contact Form 7 and WPForms through 3.3.29 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat the anti-automation control by exploiting a hardcoded static answer in the Contact Form 7 integration. Attackers can submit kc_captcha=kc_human to pass validation in cf7ic_check_if_spam() on every protected form, enabling automated contact-form spam and abuse of actions gated only by this CAPTCHA. | |
| Title | Image CAPTCHA for Contact Form 7 and WPForms 3.3.29 CAPTCHA Bypass | |
| Weaknesses | CWE-804 | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-11-12T20:41:54.273Z
Reserved: 2026-11-12T16:30:10.903Z
Link: CVE-2026-127206
Vulnrichment
No data.
NVD
Status : Deferred
Published: 2026-11-12T21:17:22.560
Modified: 2026-11-12T21:36:06.743
Link: CVE-2026-127206
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses