Vulnerabilities / Contact Form Email / WPSEC-2026-2133
Contact Form Email <= 1.3.69 - Unauthenticated CAPTCHA Bypass
Medium 5.3
CWE-804Fixed in 1.3.70
- ID
- WPSEC-2026-2133
- Plugin
- Contact Form Email (contact-form-to-email)
- Affected
- all versions before 1.3.70
- Remediation
- Update to 1.3.70 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-804
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-30
- Attack surface
- Contact Form Email on WPSec AttackSurface
- Fix released
- Published
Description
The Contact Form Email plugin for WordPress is vulnerable to CAPTCHA Bypass via the contact form submission handler in all versions up to, and including, 1.3.69, due to the handler skipping CAPTCHA validation whenever is_admin() returns true. is_admin() also returns true for unauthenticated requests to wp-admin/admin-ajax.php. This makes it possible for unauthenticated attackers to submit contact forms without solving the CAPTCHA, which allows automated spam submissions and abuse of the plugin's email notifications.
References
- https://wpsec.com/vuln/WPSEC-2026-2133/
- https://plugins.svn.wordpress.org/contact-form-to-email/tags/1.3.70/
- https://wordpress.org/plugins/contact-form-to-email/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS