CVE-2026-85117: Contact Form 7 Captcha 0.1.7 - 0.1.8 - Unauthenticated Arbitrary Shortcode Execution via Form Field Repopulation
Published Sep 9, 2026
·Updated
The Contact Form 7 Captcha WordPress plugin before 0.1.9 runs the shortcode parser over the whole rendered Contact Form 7 form, including the values a visitor submitted, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.
Affected Software
1 affected component
Contact Form 7 Captcha WordPress plugin<0.1.9
Event History
Sep 9, 2026
CVE Published
via MITRE·06:25 AM
Data Sourced
via MITRE·06:25 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
Any unauthenticated visitor who can submit an affected Contact Form 7 form can supply form-field values that are processed as shortcodes when the form is rendered.
2
What site-specific conditions affect the impact?
The practical impact depends on which shortcodes are registered on the WordPress site and what those shortcodes do. An attacker can execute arbitrary shortcodes registered on the affected site.
3
Which plugin versions are affected?
Versions before 0.1.9 are affected, including 0.1.7 and 0.1.8.