Description
The Contact Form 7 Captcha WordPress plugin before 0.1.9 runs the shortcode parser over the whole rendered Contact Form 7 form, including the values a visitor submitted, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Contact Form 7 Captcha | 0.1.7 – < 0.1.9 | 0.1.9 |
References
- https://wpscan.com/vulnerability/e791e4a6-5ec1-49c7-9448-1d83ec4f4905/ exploit vdb-entry technical-description