CAPTCHA Bypass Vulnerability in Image CAPTCHA for Contact Form 7 and WPForms
CVE-2026-127206

6.9MEDIUM

Key Information:

Vendor: Hookandhook
Status: Image Captcha For Contact Form 7 And WPforms By Hookandhook (dsgvo/gdpr)
Vendor: CVE Published:; 12 November 2026

🔔 Create Hookandhook Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-127206?

A vulnerability in the Image CAPTCHA plugin for Contact Form 7 and WPForms allows unauthenticated attackers to bypass CAPTCHA defenses. By exploiting a hardcoded static answer in the integration, attackers can submit a predetermined value ('kc_captcha=kc_human') to successfully validate their submission through the cf7ic_check_if_spam() function. This flaw enables the automated submission of spam through contact forms, undermining the intended purpose of the CAPTCHA system.

Affected Version(s)

Image CAPTCHA for Contact Form 7 and WPForms by HookAndHook (DSGVO/GDPR) 0 <= 3.3.29

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-127206 - Proof of Concept