CVE-2026-85117 affects the Contact Form 7 Captcha WordPress plugin prior to version 0.1.9. The vulnerability arises because the plugin runs the shortcode parser over the entire rendered Contact Form 7 form, including the values submitted by visitors. This flaw enables unauthenticated attackers to execute arbitrary shortcodes registered on the WordPress site, which could lead to limited information disclosure or modification of site content. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality and integrity impacts.

An unauthenticated attacker can exploit this vulnerability to execute arbitrary shortcodes on the affected WordPress site. This may allow limited unauthorized disclosure or modification of site data depending on the shortcodes available. There is no indication of availability impact or known exploits in the wild at this time.

Upgrade the Contact Form 7 Captcha WordPress plugin to version 0.1.9 or later, where this issue is fixed. Since no official patch link is provided, verify the plugin version installed and update accordingly. Patch status is not yet confirmed in the vendor advisory; check the vendor's official resources for the latest remediation guidance.