EUVD-2026-124679

Image CAPTCHA for Contact Form 7 and WPForms through 3.3.29 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat the anti-automation control by exploiting a hardcoded static answer in the Contact Form 7 integration. Attackers can submit kccaptcha=kchuman to pass...

CVE-2026-127206

Image CAPTCHA for Contact Form 7 and WPForms through 3.3.29 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat the anti-automation control by exploiting a hardcoded static answer in the Contact Form 7 integration. Attackers can submit kccaptcha=kchuman to pass...

CVE-2026-127206

The Image CAPTCHA for Contact Form 7 and WPForms plugin (versions through 3.3.29 ) is vulnerable to a CAPTCHA bypass via the Contact Form 7 integration. The root cause is a hardcoded static answer within the cf7ic_check_if_spam() function. Unauthenticated attackers can defeat anti-automation cont...