Very Simple Contact Form < 11.6 - Captcha bypass
Priority LOW 35CWE-804Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-287.
Summary
The Very Simple Contact Form WordPress plugin before 11.6 exposes the solution to the captcha in the rendered contact form, both as hidden input fields and as plain text in the page, making it very easy for bots to bypass the captcha check, rendering the page a likely target for spam bots.
Why it matters now
EPSS 0.0124 69th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Very Simple Contact Form (Unknown): 11.6
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Very Simple Contact Form | 11.6 to before 11.6 | 11.6 | Patch available | CNA |
- Very Simple Contact Form VendorUnknown Affected 11.6 to before 11.6 Fixed in 11.6 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:very_simple_contact_form_project:very_simple_contact_form:*:*:*:*:*:wordpress:*:* | before 11.6 | Vulnerable | Very Simple Contact Form Project |
- cpe:2.3:a:very_simple_contact_form_project:very_simple_contact_form:*:*:*:*:*:wordpress:*:* Versions before 11.6 Vulnerable ·Very Simple Contact Form Project
Remediation
- Fix · CNA Very Simple Contact Form (Unknown) Fixed in 11.6
Timeline
- 2026-10-02 Threatist record created from CVE-2022-1801
- 2026-10-03 Alias added: GHSA-c8xc-gc49-4vf2
References
Sources
- CVE-2022-1801 · CVE Program
- CVE-2022-1801 · NVD
- FIRST EPSS
- GHSA-c8xc-gc49-4vf2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences