CVE-2026-85117— Contact Form 7 Captcha 0.1.7 - 0.1.8 - Unauthenticated Arbitrary Shortcode Execution via Form Field Repopulation
Quick assessment
Affected
Unknown Contact Form 7 Captcha
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Contact Form 7 Captcha WordPress 插件在 0.1.9 版本之前，会在渲染后的整个 Contact Form 7 表单（包括访客提交的值）上运行短代码解析器，使得未认证的用户能够执行站点上已注册的任意短代码。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | Contact Form 7 Captcha | 0.1.7< 0.1.9 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-85117
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Contact Form 7 Captcha 0.1.7 - 0.1.8 - Unauthenticated Arbitrary Shortcode Execution via Form Field Repopulation
Source: CVE Program / CVE List V5
Vulnerability Description
The Contact Form 7 Captcha WordPress plugin before 0.1.9 runs the shortcode parser over the whole rendered Contact Form 7 form, including the values a visitor submitted, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Contact Form 7 Captcha | 0.1.7 ~ 0.1.9 | - |
|
II. Public POCs for CVE-2026-85117
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-85117
请登录查看更多情报信息。
Proof of Concept for CVE-2026-85117 (1)
-
🔗 Contact Form 7 Captcha 0.1.7 – 0.1.8 – Unauthenticated Arbitrary Shortcode Execution via Form Field Repopulation | CVE 2026-85117 | Plugin Vulnerabilities exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-09-09 · 28 CVEs total
| CVE-2026-19855 | 6.5 MEDIUM | Spam protection, Honeypot, Anti-Spam by CleanTalk < 6.87 - Unauthenticated Arbitrary Short |
| CVE-2026-83537 | 5.3 MEDIUM | WP Express Checkout < 2.5.0 - Unauthenticated Payment Bypass via wpec_process_empty_paymen |
| CVE-2026-80440 | 4.8 MEDIUM | Hustle < 7.8.14.2 - Unauthenticated Arbitrary Shortcode Execution via Success Message Plac |
| CVE-2025-15690 | Content Mask 1.7.1 - 1.8.5.5 - Contributor+ Stored XSS via Post Scripts and Styles | |
| CVE-2026-13144 | WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Payment Reset | |
| CVE-2026-13146 | WP Travel < 12.0.2 - Unauthenticated Booking Payment State Tampering via IDOR | |
| CVE-2026-14962 | ELEX WooCommerce Request a Quote < 2.4.1 - Unauthenticated SQLi via variation_id | |
| CVE-2026-18042 | WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Cancellation | |
| CVE-2026-16960 | Loops & Logic < 4.3.0 - Unauthenticated User Data and Site Option Disclosure | |
| CVE-2026-75861 | Ultimate Gift Cards for WooCommerce < 3.2.10 - Subscriber+ Gift Card Theft and Destruction | |
| CVE-2026-80339 | Payment Plugins for Stripe WooCommerce < 4.0.12 - Unauthenticated Customer PII Disclosure | |
| CVE-2026-80340 | Payment Plugins for PayPal WooCommerce < 2.0.26 - Unauthenticated Customer PII Disclosure | |
| CVE-2026-80341 | Payment Plugins for PayPal WooCommerce < 2.0.26 - Subscriber+ Stored Payment Method Assign | |
| CVE-2026-81021 | SupportCandy 3.2.9 - 3.5.2 - Unauthenticated Ticket Attachment Disclosure | |
| CVE-2026-81741 | Groundhogg < 4.7.2 - Open Redirect via 'redirect_to' Parameter | |
| CVE-2026-81022 | SupportCandy 3.3.6 - 3.5.2 - Unauthenticated Ticket Content Disclosure via Auth Code Leak | |
| CVE-2026-82185 | WPLP Cookie Consent < 4.4.2 - Subscriber+ Banner Settings Overwrite and A/B Test Data Rese | |
| CVE-2026-82848 | Masteriyo LMS 1.3.1 - 2.3.3 - Unauthenticated Course Enrollment Disclosure | |
| CVE-2026-82184 | WPLP Cookie Consent < 4.4.2 - Unauthenticated IAB TCF Consent Option Update | |
| CVE-2026-84113 | Quentn WP < 1.2.15 - Admin+ SQLi via 'orderby'/'order' Parameter |
Showing top 20 of 28 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same vendor: Unknown
-
CVE-2026-82925
Site Reviews 7.2.2 - 8.2.2 - Unauthenticated PHP Object Inje -
CVE-2026-81431
Registration Form for WooCommerce 1.1.0 - 1.1.2 - Contributo -
CVE-2026-77770
miniOrange 2FA (Free & Pro) - Unauthenticated Arbitrary Opti -
CVE-2026-77771
miniOrange 2FA (Free & Pro) - 2FA Bypass via Session-Scoped -
CVE-2026-78361
zipMoney(Zip Co) Payments Plugin for WooCommerce < 2.4.0 - U
V. Comments for CVE-2026-85117
No comments yet