Contact Form 7 Captcha
Monthly
Unauthenticated shortcode injection in the Contact Form 7 Captcha WordPress plugin before 0.1.9 allows any site visitor to execute arbitrary WordPress shortcodes registered on the target site. The plugin incorrectly passes visitor-submitted form field values through the WordPress shortcode parser without sanitization, meaning an attacker submitting a shortcode tag as a form value triggers its execution in the rendered response. With a publicly available proof-of-concept and the breadth of shortcodes available across typical WordPress installations - some of which can include files, run PHP, or interact with other plugins - the practical impact can escalate beyond the conservative C:L/I:L baseline to full remote code execution, depending on the shortcodes registered on the site.
The Contact Form 7 Captcha WordPress plugin before 0.1.2 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Contact Form 7 Captcha WordPress plugin before 0.0.9 does not have any CSRF check in place when saving its settings, allowing attacker to make a logged in user with the manage_options change. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Unauthenticated shortcode injection in the Contact Form 7 Captcha WordPress plugin before 0.1.9 allows any site visitor to execute arbitrary WordPress shortcodes registered on the target site. The plugin incorrectly passes visitor-submitted form field values through the WordPress shortcode parser without sanitization, meaning an attacker submitting a shortcode tag as a form value triggers its execution in the rendered response. With a publicly available proof-of-concept and the breadth of shortcodes available across typical WordPress installations - some of which can include files, run PHP, or interact with other plugins - the practical impact can escalate beyond the conservative C:L/I:L baseline to full remote code execution, depending on the shortcodes registered on the site.
The Contact Form 7 Captcha WordPress plugin before 0.1.2 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Contact Form 7 Captcha WordPress plugin before 0.0.9 does not have any CSRF check in place when saving its settings, allowing attacker to make a logged in user with the manage_options change. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.