Executive brief
A popular WordPress plugin that provides CAPTCHA protection for Contact Form 7 submissions contains a vulnerability that allows unauthenticated attackers to execute arbitrary WordPress shortcodes by submitting malicious form data. An attacker can inject shortcode syntax into form fields, which the plugin then processes and executes when the form is re-rendered on validation failure, potentially leading to unauthorized actions such as data exposure or content manipulation.
Technical details
The vulnerability is a shortcode injection flaw in the Simple CAPTCHA with Cloudflare Turnstile plugin (versions 1.2.2 through 1.42.2). The plugin applies the WordPress shortcode parser to the entire rendered Contact Form 7 form, including user-submitted field values. An unauthenticated attacker can submit a form with shortcode syntax embedded in textarea or other fields; when the form fails validation and is re-rendered, the plugin processes the shortcodes in those fields, leading to arbitrary shortcode execution. The attack requires Contact Form 7 to be active and configured with the vulnerable plugin. No authentication or user interaction is required beyond submitting a malicious form. The vulnerability was fixed in version 1.42.3.
Affected products
- WP Simple CAPTCHA with Cloudflare Turnstile Simple CAPTCHA with Cloudflare Turnstile 1.2.2 through 1.42.2
Timeline
- 2026-09-09: disclosed
- 2026-09-11: patched: Fixed in version 1.42.3