Description

The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin from 1.2.2 before 1.42.3 runs the shortcode parser over the whole rendered Contact Form 7 form, including the values a visitor submitted, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-11T11:16:55.660Z",
  "pubdate": "2026-09-11T11:16:55.660Z",
  "executiveSummary": "The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin, specifically versions 1.2.2 through 1.42.2, is susceptible to an arbitrary shortcode execution vulnerability.\nThe vulnerability stems from improper input sanitization and insecure processing of shortcodes within the plugin's interaction with Contact Form 7.\nAn unauthenticated attacker can exploit this flaw to execute any shortcode registered on the WordPress installation.\nThis allows remote attackers to trigger unauthorized actions, potentially leading to sensitive data exposure, cross-site scripting (XSS), or other destructive operations depending on the specific shortcodes installed on the target environment.\nThe vulnerability is critical as it requires no prior authentication and can be triggered via standard form submission vectors, making it highly accessible for exploitation by malicious actors.\nSite administrators are urged to prioritize updating the plugin to version 1.42.3 or higher to resolve the underlying security flaw.",
  "technicalDetails": "The vulnerability resides in the way the Simple CAPTCHA with Cloudflare Turnstile plugin handles the rendering process of Contact Form 7 forms. During the form generation lifecycle, the plugin improperly passes user-supplied input—specifically values submitted via the form—through the WordPress shortcode parser.\nIn WordPress, shortcodes are small snippets of code that perform dynamic functions. By default, the WordPress `do_shortcode()` function parses content for registered shortcodes. When a plugin recursively calls this function on unsanitized user input, it allows an attacker to inject arbitrary shortcode tags into the data stream.\nThe attack flow begins when an attacker identifies a contact form protected or integrated by the vulnerable plugin. Instead of providing standard form data, the attacker submits malicious strings formatted as WordPress shortcodes (e.g., [some_sensitive_shortcode]). The plugin, failing to validate or sanitize these submission values, processes them as legitimate commands by executing the `do_shortcode()` logic over the entire form output.\nSince the execution context is triggered by the plugin during form rendering, the system treats the injected shortcode as if it were legitimate site content. This enables the attacker to invoke functional shortcodes defined by other plugins or themes. For example, if a site has a shortcode that retrieves database information, displays private post content, or performs administrative actions, the attacker can leverage these capabilities by injecting the corresponding shortcode tags.\nThe root cause is the execution of global shortcode parsing on untrusted, unvalidated input. By not restricting the parsing scope, the plugin exposes the entire WordPress shortcode library to remote, unauthenticated users. This bypasses typical access controls because the execution is performed server-side under the context of the WordPress engine when the form output is rendered.\nThe impact is determined by the ecosystem of shortcodes present on the victim's WordPress instance. An attacker can use this vulnerability to perform unauthorized actions such as escalating privileges, modifying content, or extracting sensitive information from the database, provided an appropriate shortcode exists to facilitate those actions."
}