CVE-2022-1801 json
Very Simple Contact Form < 11.6 - Captcha bypass
published 2022-06-20 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-25080
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.2%
- EPSS 1.2% chance of exploitation in 30 days, percentile 69%
- public exploits
- 0
- none known
Summary
The Very Simple Contact Form WordPress plugin before 11.6 exposes the solution to the captcha in the rendered contact form, both as hidden input fields and as plain text in the page, making it very easy for bots to bypass the captcha check, rendering the page a likely target for spam bots.
Patch / fix
- very_simple_contact_form_project very_simple_contact_form 11.6
Exploit prediction
1.24% chance of exploitation in the next 30 days, higher than 69% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- wpscan.com https://wpscan.com/vulnerability/a5c97809-2ffc-4efb-8c80-1b734361cd06 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N |
Affected products
- Unknown Very Simple Contact Form
Classification
- Weakness
- Technology feeds
References
-
wpscan.com
/vulnerability/a5c97809-2ffc-4efb-8c80-1b734361cd06
exploit, third-party-advisory
Sources
- CVE List CVE-2022-1801
- NVD CVE-2022-1801
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.