CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
Improper Restriction of Excessive Authentication Attempts vulnerability in Forge12 Interactive GmbH Captcha/Honeypot for Contact Form 7 allows Functionality Bypass.This issue affects Captcha/Honeypot for Contact Form 7: from n/a through 1.11.3.
Explanation of Vulnerability in Simple Terms
The Captcha/Honeypot for Contact Form 7 plugin contains a weakness in its rate-limiting or brute-force protection mechanism (CWE-307). An attacker can send repeated requests to bypass CAPTCHA validation without authentication. This allows automated attacks against contact forms and other protected endpoints. Update to a version newer than 1.11.3.
What an attacker can do
Bypass CAPTCHA protection and submit forms repeatedly without solving the challenge.
Potential impact on your site
Contact forms and other protected endpoints become vulnerable to spam, automated attacks, and form submission abuse.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
