CVE-2026-127206

Image CAPTCHA for Contact Form 7 and WPForms through 3.3.29 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat the anti-automation control by exploiting a hardcoded static answer in the Contact Form 7 integration. Attackers can submit kc captcha=kc human to pass validation in cf7ic check if spam() on every protected form, enabling automated contact-form spam and abuse of actions gated only by this CAPTCHA.