PLUGIN SECURITY
Is Contact Form 7 Image Captcha safe?
Adds an Image CAPTCHA to Contact Form 7 and WPForms, GDPR ready, perfect WPForms or Contact Form 7 Spam Protection Image CAPTCHA, adds a honeypot
What this plugin does
- Slug:
contact-form-7-image-captcha - Author: hookandhook
- 70000+ active installs
- 94/100 rating (49 reviews on wordpress.org)
- 1598126 all-time downloads
- On WordPress.org since 2015-07-21
captchacontact form 7GDPRspamWPForms
Maintenance status
- Last updated: 2026-08-24 8:36am GMT
- Tested up to WordPress: 7.1.4
- Requires PHP: 7.0+
Known vulnerabilities
1 known CVE on file for Contact Form 7 Image Captcha. Reported between 2026 and 2026.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-127206 | Image CAPTCHA for Contact Form 7 and WPForms by HookAndHook (DSGVO/GDPR) [contact-form-7-image-captcha] <= 3.3.29 (unfixed) | Guessable CAPTCHA | Medium 6.9 | < 3.3.29 | 3.3.29 | 2026-11-12 | — |
How to fix it
Update this plugin to the latest release from wordpress.org — each CVE above lists the exact release that fixed it ("Fixed in") when one is on file.
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- SiteGuard WP Plugin — 600000+ active installs — 86/100 (15) — max PHP 8.4
- Database Addon for Contact Form 7 – CFDB7 — 600000+ active installs — 100/100 (1875) — max PHP 8.4
- CF7 Apps – Addons for Contact Form 7 (Honeypot, Database, Redirection, Webhook, etc.) — 300000+ active installs — 76/100 (135) — max PHP 8.4
- Really Simple CAPTCHA — 300000+ active installs — 84/100 (131) — max PHP 8.4
- Advanced Google reCAPTCHA — 200000+ active installs — 96/100 (431) — max PHP 8.4
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.