{
 "id": "WPSEC-2026-2133",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2133/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2133/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2133/index.md",
 "title": "Contact Form Email <= 1.3.69 - Unauthenticated CAPTCHA Bypass",
 "description": "The Contact Form Email plugin for WordPress is vulnerable to CAPTCHA Bypass via the contact form submission handler in all versions up to, and including, 1.3.69, due to the handler skipping CAPTCHA validation whenever is_admin() returns true. is_admin() also returns true for unauthenticated requests to wp-admin/admin-ajax.php. This makes it possible for unauthenticated attackers to submit contact forms without solving the CAPTCHA, which allows automated spam submissions and abuse of the plugin's email notifications.",
 "plugin": {
  "slug": "contact-form-to-email",
  "name": "Contact Form Email",
  "full_name": "Contact Form Email",
  "wordpress_org": "https://wordpress.org/plugins/contact-form-to-email/",
  "advisories_url": "https://wpsec.com/vuln/plugin/contact-form-to-email/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/contact-form-to-email"
 },
 "type": "AUTHBYPASS",
 "cwe": [
  "CWE-804"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.3.70",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.3.70"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.3.70",
 "remediation": "Update to 1.3.70 or later.",
 "fix_released": "2026-10-29T18:58:28+00:00",
 "published": "2026-10-30T19:41:51+00:00",
 "updated": "2026-10-30T09:24:47.012464+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2133/",
  "https://plugins.svn.wordpress.org/contact-form-to-email/tags/1.3.70/",
  "https://wordpress.org/plugins/contact-form-to-email/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/contact-form-to-email",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-30"
 }
}