The Accessible Form Captcha extension embeds the solution to each CAPTCHA directly in the image data that forms the CAPTCHA challenge. Anyone able to retrieve a CAPTCHA image can extract the correct answer and submit it, effectively bypassing the intended bot protection. Since forms that rely on this captcha as their sole anti‑bot mechanism are exposed, automated clients can submit forms without any interaction.

TYPO3 Extension "Accessible Form Captcha" (bw_captcha). No specific version information is listed, so all versions using the default configuration where the audio feature is enabled are potentially vulnerable.

The CVSS score of 6.9 indicates moderate severity. The EPSS score of less than 1% suggests a very low probability of exploitation at the time of analysis, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is simply requesting the CAPTCHA image and reading the embedded answer, so the condition for exploitation is minimal – an automated client can perform the attack without any privileged access or additional vulnerability.