CVE-2026-127206

EUVD-2026-124679

12.11.2026, 21:17

Image CAPTCHA for Contact Form 7 and WPForms through 3.3.29 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat the anti-automation control by exploiting a hardcoded static answer in the Contact Form 7 integration. Attackers can submit kc_captcha=kc_human to pass validation in cf7ic_check_if_spam() on every protected form, enabling automated contact-form spam and abuse of actions gated only by this CAPTCHA.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	5.3 MEDIUM	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Common Weakness Enumeration

CWE-804 - Guessable CAPTCHA
The software uses a CAPTCHA challenge, but the challenge can be guessed or automatically recognized by a non-human actor.

References

https://hackmd.io/@buiih/S1pRnCeCfl

https://wordpress.org/plugins/contact-form-7-image-captcha/

https://www.vulncheck.com/advisories/image-captcha-for-contact-form-7-and-wpforms-captcha-bypass