Executive brief
Contact Form 7 Captcha is a WordPress plugin that extends the popular Contact Form 7 form builder. The plugin incorrectly processes user-submitted form data through WordPress's shortcode parser, allowing attackers to inject and execute arbitrary shortcodes without authentication. This could enable data exfiltration, code execution, or malicious content injection on affected websites.
Technical details
The vulnerability is a shortcode injection flaw in the Contact Form 7 Captcha plugin (versions 0.1.7–0.1.8). The plugin runs the WordPress shortcode parser over the entire rendered form, including user-submitted field values, without proper sanitization. An unauthenticated attacker can submit a form with square-bracket-delimited shortcodes (e.g., [audio src=/marker.mp3]) in text fields; the plugin re-renders the form and executes the shortcode, allowing invocation of any registered WordPress shortcode. The attack requires only network access and knowledge of the form's HTML structure; no authentication or user interaction is needed. While the output lands inside a textarea (RCDATA), side effects of shortcode callbacks still execute server-side. The vulnerability is fixed in version 0.1.9.
Affected products
- WordPress Contact Form 7 Captcha 0.1.7–0.1.8
Timeline
- 2026-09-07: disclosed
- 2026-09-09: patched: Fixed in version 0.1.9