Unauthenticated arbitrary shortcode execution in Contact Form 7 Captcha

The Contact Form 7 Captcha WordPress plugin before 0.1.9 runs the shortcode parser over the whole rendered Contact Form 7 form, including the values a visitor submitted, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.

• Contact Form 7 Captcha: vendor not identified. The structured record marks 0.1.7 with a semver condition of less than 0.1.9 as affected; WPScan describes this interval as 0.1.7 through 0.1.8.
• The default status outside the supplied range is unaffected, but the record does not confirm the status of unlisted parallel or later branches.

Contact Form 7 Captcha runs the shortcode parser over the entire rendered Contact Form 7 form rather than limiting parsing to trusted template content. Values submitted by a visitor can therefore become input to the parser, creating CWE-74, improper neutralization of special elements before processing by a downstream component. The attacker does not need authentication and can reach the behavior remotely through an affected form. The site must have the affected plugin and a Contact Form 7 form that renders or processes submitted values. The record does not identify which registered shortcodes are present on a particular site or fully describe the privilege context in which those shortcodes execute.

Exploitation is reachable over the network by an unauthenticated visitor submitting data to an affected form, with no additional interaction from another user required. The record characterizes the attack as low complexity and requiring no privileges. The public_exploit field is true, and the WPScan page labels the reference as an exploit, but that page states that the PoC will be displayed on September 21, 2026 and does not currently provide the PoC content. The record does not establish observed exploitation or associate the flaw with a named campaign, victim, or incident.

An attacker can cause a shortcode registered on the site to execute through a value submitted in a form. The technical result may include limited data disclosure or modification of content or state handled by that shortcode. The privilege level and practical scope depend on the implementation of each shortcode; the record does not confirm privilege escalation, escape from the WordPress context, or an availability effect. Because no specific shortcode is identified, the same level of impact should not be assumed for every site running the plugin.

The flaw expands shortcode processing from trusted form content to data controlled by a visitor. Depending on the shortcodes registered on the site, this could disclose limited data, modify content, or trigger unintended operations in WordPress. The effect on an organisation depends on its registered shortcodes, the privileges those shortcodes use, and which forms are publicly reachable. No availability impact is established in the record, and a data breach should not be assumed without separate evidence.

1. Update Contact Form 7 Captcha to 0.1.9, which WPScan identifies as fixed.
2. Verify the deployed release on each WordPress site after updating and test public Contact Form 7 forms for the reported form-repopulation behavior.
3. Review custom and sensitive shortcodes registered on the site because the practical impact depends on which shortcodes the plugin can invoke.
4. The record provides no confirmed temporary mitigation. If an update cannot be applied, treat related forms as exposed and obtain vendor guidance rather than relying on an unverified workaround.
5. Do not infer that every later or parallel release branch is covered merely because 0.1.9 is identified as fixed.

1. Inventory WordPress sites where Contact Form 7 Captcha is installed or active, then compare the deployed release with the affected boundary.
2. Identify Contact Form 7 forms using the plugin and review how they render submitted values after validation errors or form repopulation.
3. Identify registered shortcodes that could be invoked from form-field data, and check whether shortcode output appears outside the expected processing flow.
4. As a precaution, review application logs and form-submission history for shortcode-like input or unexpected shortcode output. This is general monitoring guidance, not a source-confirmed IOC.
5. Do not treat the absence of suspicious log entries as proof of safety; the record provides no specific log event or IOC.