# Contact Form Email <= 1.3.69 - Unauthenticated CAPTCHA Bypass

- **ID:** WPSEC-2026-2133
- **Plugin:** Contact Form Email (`contact-form-to-email`), https://wordpress.org/plugins/contact-form-to-email/
- **Affected versions:** all versions before 1.3.70
- **Fixed in:** 1.3.70 (Update to 1.3.70 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-804
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/contact-form-to-email
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2133/

## Description

The Contact Form Email plugin for WordPress is vulnerable to CAPTCHA Bypass via the contact form submission handler in all versions up to, and including, 1.3.69, due to the handler skipping CAPTCHA validation whenever is_admin() returns true. is_admin() also returns true for unauthenticated requests to wp-admin/admin-ajax.php. This makes it possible for unauthenticated attackers to submit contact forms without solving the CAPTCHA, which allows automated spam submissions and abuse of the plugin's email notifications.

## References

- https://wpsec.com/vuln/WPSEC-2026-2133/
- https://plugins.svn.wordpress.org/contact-form-to-email/tags/1.3.70/
- https://wordpress.org/plugins/contact-form-to-email/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2133/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.