UpHeron
All vulnerabilities

WordPress plugins

CVE-2026-127206

Image CAPTCHA for Contact Form 7 and WPForms 3.3.29 CAPTCHA Bypass

Severity
Medium 6.9
Published
12 Nov 2026
Last changed
12 Nov 2026
Added to UpHeron
12 Nov 2026
Weakness
CWE-804
Attack
Over the network · No login needed · No user action needed
Attacker can
Change some data
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Sources
CVE Program

Description

Image CAPTCHA for Contact Form 7 and WPForms through 3.3.29 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat the anti-automation control by exploiting a hardcoded static answer in the Contact Form 7 integration. Attackers can submit kc_captcha=kc_human to pass validation in cf7ic_check_if_spam() on every protected form, enabling automated contact-form spam and abuse of actions gated only by this CAPTCHA.

From the CVE Program.

Affected software

SoftwareAffected versions
Contact Form 7 Image Captcha (WordPress plugin)WordPress plugins · wp-plugin:contact-form-7-image-captcha
  • Every version up to 3.3.29

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-127206