CVE-2022-1801: Very Simple Contact Form < 11.6 - Captcha bypass

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-06-20 · updated 2026-06-17
Weakness: CWE-804

Description

The Very Simple Contact Form WordPress plugin before 11.6 exposes the solution to the captcha in the rendered contact form, both as hidden input fields and as plain text in the page, making it very easy for bots to bypass the captcha check, rendering the page a likely target for spam bots.

Affected products

Very Simple Contact Form: before 11.6 — fixed in 11.6

How to fix

Upgrade to a fixed version: Very Simple Contact Form 11.6. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/a5c97809-2ffc-4efb-8c80-1b734361cd06
https://wpscan.com/vulnerability/a5c97809-2ffc-4efb-8c80-1b734361cd06

Get alerted when CVE-2022-1801 or the next vulnerability affects your stack