Description
The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin from 1.2.2 before 1.42.3 runs the shortcode parser over the whole rendered Contact Form 7 form, including the values a visitor submitted, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Simple CAPTCHA with Cloudflare Turnstile | 1.2.2 – < 1.42.3 | 1.42.3 |
References
- https://wpscan.com/vulnerability/7bab04a6-59ef-4b4f-a374-ddc5a2a52b60/ exploit vdb-entry technical-description