CVE-2026-127206

MediumCVSS 5.3/10Last modified Nov 12, 2026

Description

Image CAPTCHA for Contact Form 7 and WPForms through 3.3.29 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat the anti-automation control by exploiting a hardcoded static answer in the Contact Form 7 integration. Attackers can submit kc_captcha=kc_human to pass validation in cf7ic_check_if_spam() on every protected form, enabling automated contact-form spam and abuse of actions gated only by this CAPTCHA.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-804

Affected software

No affected versions have been published.

Timeline

Published: Nov 12, 2026
Last modified: Nov 12, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1272075.4Sendcloud for WooCommerce through 1.0.41 contains a missing authorization vulnerability that allows authenticated low-privileged users, incl CVE-2026-1272088.8datamodel-code-generator before 0.84.0 contains a code injection vulnerability that allows attackers to achieve arbitrary code execution by CVE-2026-1272094.0Xiaomi Mi Browser Android Application (com.mi.globalbrowser) before 14.66.0-gn contains a path traversal vulnerability in the exported Third CVE-2026-127218.6The Kirki WordPress plugin before 6.0.13 does not properly sanitise and escape a value taken from the request before using it in a SQL stat CVE-2026-1272116.5MultiVendorX plugin for WordPress before 5.0.22 contains a broken access control vulnerability in the /wp-json/multivendorx/v1/stores REST r CVE-2026-127228.2Missing authentication for critical function vulnerability in FTC Software IT Services FTC E-Commerce Management Panel allows Authentication CVE-2026-127235.3The Kirki WordPress plugin before 6.0.12 does not perform any authorisation check on one of its REST routes, allowing unauthenticated users CVE-2026-1272356.1A reflected cross-site scripting vulnerability exists in the web user interface of multiple versions of OpenNMS Meridian and Horizon. Severa CVE-2026-1272365.4An argument injection vulnerability exists in the ad-hoc RRD graph feature of multiple versions of OpenNMS Meridian and Horizon. The ad-hoc CVE-2026-127244.3The Kirki WordPress plugin before 6.0.12 does not sanitise or escape the email subject and body values supplied in a request before includi CVE-2026-127255.9A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and query logging are both enabled, logging of DS or DNSKEY replie CVE-2026-127266.3A flaw was found in the AWX GitHub webhook integration. When processing GitHub pull_request webhooks, the controller stores the pull_request