CVE-2026-85586 PUBLISHED

phpMyFAQ before 4.1.8 CAPTCHA Bypass via store parameter

Assigner: VulnCheck
Reserved: 04.09.2026 Published: 04.09.2026 Updated: 04.09.2026

phpMyFAQ versions before 4.1.8 fail to validate CAPTCHA when the store parameter is set to 'now' in question submission requests. Unauthenticated attackers can bypass CAPTCHA protection and submit unlimited questions directly, causing database pollution and triggering outgoing mail notifications.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS Score: 6.9

Product Status

Vendor thorsten
Product phpMyFAQ
Versions Default: unaffected
  • affected from 0 to 4.1.8 (excl.)
  • Version 4.1.8 is unaffected

Credits

  • skeletonsec reporter

References

Problem Types

  • Improper Control of Interaction Frequency CWE