Description
Image CAPTCHA for Contact Form 7 and WPForms through 3.3.29 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat the anti-automation control by exploiting a hardcoded static answer in the Contact Form 7 integration. Attackers can submit kc_captcha=kc_human to pass validation in cf7ic_check_if_spam() on every protected form, enabling automated contact-form spam and abuse of actions gated only by this CAPTCHA.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| hookandhook | Image CAPTCHA for Contact Form 7 and WPForms by HookAndHook (DSGVO/GDPR) | 0 ≤3.3.29 | — |