The Webform Share submodule, which allows site builders to expose webforms for embedding on other sites, contains a flaw where submissions for Ajax-enabled webforms can bypass anti-spam protections. This occurs when the webform relies on compatible Form-API-based anti-spam protections, such as Honeypot or Antibot. Approximately 436,400 instances of Drupal were identified globally as potentially exposed.