CVE-2026-85117: Unknown Contact Form 7 Captcha

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

The Contact Form 7 Captcha WordPress plugin before 0.1.9 runs the shortcode parser over the whole rendered Contact Form 7 form, including the values a visitor submitted, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.

Affected products

• Unknown Contact Form 7 Captcha: from 0.1.7, before 0.1.9 (fixed in 0.1.9)

Published 2026-09-09. Last modified 2026-09-09.