CVE-2026-85116: WordPress CAPTCHA Plugin RCE Vulnerability

CVE-2026-85116 Overview

CVE-2026-85116 affects the Simple CAPTCHA with Cloudflare Turnstile WordPress plugin, versions 1.2.2 through 1.42.2. The plugin runs the WordPress shortcode parser over the entire rendered Contact Form 7 form, including values submitted by visitors. Unauthenticated attackers can inject arbitrary shortcodes registered on the target site through form field submissions. The vulnerability is classified under [CWE-74] Improper Neutralization of Special Elements in Output.

Critical Impact

Unauthenticated remote attackers can execute any shortcode registered on the WordPress site by submitting crafted values through Contact Form 7 fields, potentially exposing sensitive data or altering site behavior.

Affected Products

• Simple CAPTCHA with Cloudflare Turnstile WordPress plugin version 1.2.2 through 1.42.2
• WordPress installations using this plugin alongside Contact Form 7
• Sites where privileged shortcodes are registered by other plugins or themes

Discovery Timeline

• 2026-09-11 - CVE-2026-85116 published to the National Vulnerability Database
• 2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-85116

Vulnerability Analysis

The Simple CAPTCHA with Cloudflare Turnstile plugin integrates with Contact Form 7 to add bot protection. During form rendering, the plugin invokes the WordPress do_shortcode() parser against the complete output of the Contact Form 7 form. This output includes visitor-supplied values that were echoed back into form fields.

Because the parser runs after user input has been merged into the markup, any bracketed shortcode syntax entered by a visitor becomes executable. WordPress shortcodes registered by other plugins can perform actions such as reading options, rendering user lists, or exposing internal data. An unauthenticated attacker submits form fields containing shortcode markup, and the server executes those shortcodes with the context available to the rendering page.

The issue falls under improper neutralization of special elements passed to a downstream component [CWE-74]. The attack requires no authentication and no user interaction beyond submission of the vulnerable form.

Root Cause

The root cause is the plugin calling the shortcode parser on rendered form HTML that contains untrusted input. Shortcode parsing should never be applied to attacker-controlled strings without sanitization. The correct approach is to parse shortcodes only on trusted template content, then insert sanitized visitor data afterward.

Attack Vector

An attacker locates a public Contact Form 7 form on a target site running the vulnerable plugin. The attacker submits the form with a field value containing a shortcode expression, for example a shortcode that outputs site configuration or user information. The server renders the form with the submitted value embedded, then runs the shortcode parser over the entire result and executes the injected shortcode.

// No verified proof-of-concept code is available.
// See the WPScan advisory for technical details:
// https://wpscan.com/vulnerability/7bab04a6-59ef-4b4f-a374-ddc5a2a52b60/

Detection Methods for CVE-2026-85116

Indicators of Compromise

• Contact Form 7 submissions containing bracketed shortcode syntax such as [shortcode_name ...] within input fields
• Unexpected HTTP responses from Contact Form 7 endpoints that include rendered content from unrelated shortcodes
• Web server access logs showing repeated POST requests to /wp-admin/admin-ajax.php or Contact Form 7 submission endpoints from a single source

Detection Strategies

• Inspect WordPress request bodies for square-bracket patterns matching registered shortcode names in POST parameters
• Correlate Contact Form 7 submissions with subsequent responses containing content that does not appear in the original form template
• Audit installed plugin versions to identify Simple CAPTCHA with Cloudflare Turnstile installations at or below version 1.42.2

Monitoring Recommendations

• Enable verbose logging on the Contact Form 7 submission handler and forward events to a centralized log platform
• Monitor for anomalous form submission volumes that could indicate automated shortcode probing
• Alert on responses to form submissions that exceed expected size or contain content from privileged shortcodes

How to Mitigate CVE-2026-85116

Immediate Actions Required

• Update the Simple CAPTCHA with Cloudflare Turnstile plugin to version 1.42.3 or later
• Inventory all WordPress sites using Contact Form 7 to identify installations of the affected plugin
• Review the list of shortcodes registered on affected sites and disable any that expose sensitive data

Patch Information

The vendor released version 1.42.3 to remediate the shortcode parsing behavior. Administrators should apply the update through the WordPress plugin management interface. Reference the WPScan Vulnerability Details advisory for the full description.

Workarounds

• Temporarily deactivate the Simple CAPTCHA with Cloudflare Turnstile plugin until the patched version can be installed
• Deploy a web application firewall rule that blocks POST parameters containing square-bracket shortcode syntax on Contact Form 7 endpoints
• Restrict which plugins register shortcodes on the site to reduce the surface available to an attacker

# Update the affected plugin using WP-CLI
wp plugin update simple-cloudflare-turnstile --version=1.42.3

# Verify the installed version
wp plugin get simple-cloudflare-turnstile --field=version