CVE-2026-85117 Overview
CVE-2026-85117 affects the Contact Form 7 Captcha WordPress plugin in versions before 0.1.9. The plugin runs the WordPress shortcode parser over the entire rendered Contact Form 7 form, including values submitted by site visitors. Unauthenticated users can inject arbitrary shortcodes registered on the target site through form field submissions. The flaw is classified as improper neutralization of special elements in output used by a downstream component [CWE-74].
Critical Impact
Unauthenticated attackers can execute any shortcode registered on the affected WordPress site by submitting crafted values through a Contact Form 7 form protected by the vulnerable captcha plugin.
Affected Products
- Contact Form 7 Captcha WordPress plugin versions prior to 0.1.9
- WordPress sites using Contact Form 7 with the vulnerable captcha add-on
- Any site exposing forms rendered through the affected plugin to unauthenticated visitors
Discovery Timeline
- 2026-09-09 - CVE-2026-85117 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-85117
Vulnerability Analysis
The Contact Form 7 Captcha plugin applies the WordPress do_shortcode() processing routine to the fully rendered form output. Because rendering occurs after visitor input is echoed back into the form markup, any shortcode syntax present in submitted field values is parsed and executed. The parser does not distinguish between shortcodes authored by site administrators and shortcodes originating from untrusted request data. This turns any exposed form field into an injection point for shortcode expansion.
The impact depends on which shortcodes exist on the target site. Shortcodes registered by other plugins or the active theme may expose administrative data, execute queries, render arbitrary content, or trigger privileged actions when invoked without expected context. Attackers do not need authentication or user interaction beyond submitting the form.
Root Cause
The root cause is unsanitized reprocessing of user-supplied input through a downstream interpreter. The plugin invokes shortcode parsing on the rendered form HTML rather than only on trusted administrator content. Visitor-submitted values are reflected into that output prior to parsing, so they are treated as executable shortcode syntax.
Attack Vector
The attack is remote and unauthenticated over the network. An attacker submits a Contact Form 7 form that includes shortcode syntax such as [shortcode_name attr="value"] inside any input the plugin reflects back into the rendered form. The plugin then expands the shortcode during rendering, executing whatever handler is registered on the site. Additional technical detail is available in the WPScan Vulnerability Report.
Detection Methods for CVE-2026-85117
Indicators of Compromise
- POST requests to Contact Form 7 endpoints containing shortcode syntax ([ and ]) inside form field values.
- Web server or PHP logs showing shortcode handlers invoked during wpcf7 form submission requests.
- Unexpected data returned in form confirmation responses that matches output from privileged shortcodes.
Detection Strategies
- Inspect WordPress access logs for wp-admin/admin-ajax.php or REST endpoint calls tied to Contact Form 7 with bracketed payloads in POST bodies.
- Enumerate installed plugins to identify Contact Form 7 Captcha versions below 0.1.9.
- Review the site's registered shortcode inventory to assess which shortcodes an attacker could reach through this flaw.
Monitoring Recommendations
- Alert on form submissions whose field values contain shortcode delimiters and are followed by anomalous outbound data or database queries.
- Track plugin version drift across managed WordPress sites and flag hosts running vulnerable releases.
- Enable and centralize WordPress debug and error logs to correlate shortcode execution with form submission traffic.
How to Mitigate CVE-2026-85117
Immediate Actions Required
- Upgrade the Contact Form 7 Captcha plugin to version 0.1.9 or later on every affected WordPress site.
- Audit registered shortcodes and disable any that expose sensitive data or privileged actions when invoked without expected context.
- Restrict access to Contact Form 7 endpoints behind a web application firewall rule that blocks shortcode delimiters in submitted values.
Patch Information
The vendor addressed the issue in Contact Form 7 Captcha version 0.1.9. The fix scopes shortcode parsing so that visitor-supplied field values are no longer expanded during form rendering. Refer to the WPScan Vulnerability Report for reference details.
Workarounds
- Temporarily deactivate the Contact Form 7 Captcha plugin until the update to 0.1.9 or later is applied.
- Deploy a WAF rule that rejects Contact Form 7 submissions containing [ or ] characters in text field values.
- Unregister high-risk shortcodes on public-facing sites where those shortcodes are not required for rendering.
# Configuration example: upgrade the plugin via WP-CLI
wp plugin update contact-form-7-captcha --version=0.1.9
wp plugin list --name=contact-form-7-captcha --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
