CVE-2026-127206 · Package
NO FIX YET · SEE WHAT TO DO
Image CAPTCHA for Contact Form 7 and WPForms through version 3.3.29 has a hardcoded static answer in its Contact Form 7 integration. An unauthenticated attacker can submit the value kc_captcha=kc_human to pass the check on every protected form, letting automated spam through.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the Image CAPTCHA plugin through version 3.3.29 with the Contact Form 7 integration active are exposed, because the bypass sits in the check that runs on every protected form. Sites without this plugin or without the Contact Form 7 integration can skip it. The sources do not say whether WPForms forms are affected by the same hardcoded value.
Not affected if no-cf7-integration, plugin-not-installed
Who cares contact-form-7, self-hosted, wordpress, wpforms
Image CAPTCHA for Contact Form 7 and WPForms through 3.3.29 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat the anti-automation control by exploiting a hardcoded static answer in the Contact Form 7 integration. Attackers can submit kc_captcha=kc_human to pass validation in cf7ic_check_if_spam() on every protected form, enabling automated contact-form spam and abuse of actions gated only by this CAPTCHA.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.