Is CVE-2026-85586 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85586 being exploited in the wild.

How severe is CVE-2026-85586?

Informational severity, with a CVSS score of 6.9, published 4 September 2026.

Which products and versions are affected?

phpMyFAQ phpMyFAQ before 4.1.8.

Is there a fix for CVE-2026-85586?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-85586 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-85586?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85586: phpMyFAQ CAPTCHA bypass in question submission via store parameter

CVE-2026-85586 · Severity: info · CVSS 6.9 · Published 2026-09-04

phpMyFAQ is a popular open-source FAQ management system that allows website visitors to submit questions anonymously through a web interface. A vulnerability allows attackers to bypass CAPTCHA protections and submit unlimited fake questions without authentication, causing database pollution and causing the system to send unwanted email notifications to arbitrary addresses, effectively using the victim's mail server as a relay.

Quick answers

Is CVE-2026-85586 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85586 being exploited in the wild.
How severe is CVE-2026-85586?: Informational severity, with a CVSS score of 6.9, published 4 September 2026.
Which products and versions are affected?: phpMyFAQ phpMyFAQ before 4.1.8.
Is there a fix for CVE-2026-85586?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-85586 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-85586?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a logic flaw in the CAPTCHA validation control (CWE-799: Improper Control of Interaction Frequency). When an anonymous user submits a question with the "store" parameter set to "now", the server skips CAPTCHA validation entirely, intended for a two-phase UX workflow but never enforced on the server side. The endpoint lacks CSRF token protection and accepts arbitrary attacker-supplied email addresses. An unauthenticated attacker can send a simple POST request to the question submission endpoint with store=now to bypass all validation and spam the system; each submission triggers an outgoing mail notification, potentially relaying emails to attacker-chosen recipients. The vulnerability affects phpMyFAQ versions before 4.1.8 when main.enableAskQuestions=true and records.allowQuestionsForGuests=true (default settings).

Affected products

phpMyFAQ phpMyFAQ before 4.1.8

Timeline

2026-08-20: disclosed: GitHub Security Advisory (GHSA-72vj-pvm4-mm7x) published
2026-09-04: advisory: CVE-2026-85586 published on NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.