Spam bots bypass hCaptcha with Contact Form 7

OK, I think I’ve worked out what the problem is.

Your plugin uses wpcf7_validate hook to validate the h-captcha-response.

Which is fine and works.

But … some bots are managing to process Contact Form 7 forms without firing wpcf7_validate. I know this because I just received another spam email and my debug.log file was empty despite having this …

add_filter('wpcf7_validate', 'domain_support_wpcf7_validate', 10, 2);

function domain_support_wpcf7_validate($result, $tag) {

error_log(print_r($_POST, true));

return $result;

}

And yes, testing the form produced this …

[06-Dec-2022 10:18:52 UTC] Array
(
    [your-name] => Oliver Campion
    [your-email] => info@XXXXXXXX.co.uk
    [your-telephone] => XXXXXXXX
    [your-message] => Testing form
    [g-recaptcha-response] => -response removed-
    [h-captcha-response] => -response removed-
)

… and another bot that used the form produced this (no email was received, which is good) …

[06-Dec-2022 20:53:39 UTC] Array
(
    [your-name] => SpamName
    [your-email] => spammyaddress@gmail.com
    [your-telephone] => 86581962762
    [your-message] => <b>-spam content removed-</b> 
    [submit] => Send
)

So we know that …

1. Your plugin works on Contact Form 7 for real humans and email is sent (wpcf7_validate hook is fired)
2. Your plugin works on Contact Form 7 to detect bots that submit the form the same way a human would using a web browser and email is not sent (wpcf7_validate hook is fired)
3. Your plugin does not work on Contact Form 7 to detect bots that submit the form in a way that wpcf7_validate hook is not fired and the spam email is delivered

I hope this helps you discover the problem.

If you still need me to find out how they are submitting forms on Contact Form 7 and bypassing the wpcf7_validate hook, let me know but you should have enough information to solve the problem yourselves now.

Oliver

I’m afraid not.

I have discovered you have quite a serious bug with your integration with Contact Form 7 which will need addressing ASAP because it affects all users of your plugin that use Contact Form 7 (which I’m assuming is quite a few).

I will attempt to explain what the issue is as simply as possible so you are able to understand.

I will also provide a fix so you can rectify the problem.

On line 112 of /src/php/CF7/CF7.php …

$wpcf7_id = filter_var(
		// phpcs:ignore WordPress.Security.NonceVerification.Missing
			isset( $_POST['_wpcf7'] ) ? wp_unslash( $_POST['_wpcf7'] ) : 0,
			FILTER_VALIDATE_INT
		);

… you are using $_POST['_wpcf7'] to get the ID of the submitted form. I believe this method was depreciated with v5.2 of Contact Form 7 in July 2020 and is not always in the $_POST array.

This means that on line 118 …

		if ( empty( $wpcf7_id ) ) {
			return $result;
		}

… the hCaptcha hcaptcha_request_verify() is by-passed because $wpcf7_id has been set to zero.

So … not only does this mean that spam bots have been able to bypass your verification system with Contact Form 7 by omitting the _wpcf7 element of the $_POST array but also humans may not have had their hCaptcha verified since July 2020!

In order to fix this problem, please replace the code on line 112 above with this …

$wpcf7_form = WPCF7_ContactForm::get_current();
$wpcf7_id = $wpcf7_form->id;

Oliver

The issue is not that wpcf7_validate is not being fired (as I had originally thought) but the _wpcf7 element being omitted (not unset) from the $_POST() array.

_wpcf7 is not required in $_POST() because the form ID is taken from the REST endpoint namely …

[REQUEST_URI] => /wp-json/contact-form-7/v1/contact-forms/{ID}/{name}

So your plugin requiring it to be present to validate the hCaptcha key is flawed.

Thank you for taking this onboard, however … I’ve had a quick look. Before your plugin would generate the contact form shortcode then search for the site key to make sure that the form requires an hCaptcha. Your new code will try to verify all form submissions whether the form has an hCaptcha field or not. Won’t that break the form for any forms that are deliberately not using hCaptcha?

Oliver

• This reply was modified 3 years, 3 months ago by Oliver Campion.

Thank you for the update.

I will return to this thread when v2.2.0 is released.

Oliver

Yes! I don’t want to jinx it but it would indeed appear to have resolved the issue!

I’m glad I was able to help you.

I’ll mark the ticket as resolved.

Oliver