Simple CAPTCHA with Cloudflare Turnstile < 1.42.3 - Unauthenticated Arbitrary Shortcode Execution

Description

The Simple CAPTCHA with Cloudflare Turnstile plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in all versions up to, and including, 1.42.1. This is due to use of do_shortcode() on the wpcf7_form_elements filter, which processes rendered form HTML including user-submitted values reflected back to the visitor. This makes it possible for unauthenticated attackers to inject arbitrary shortcode output into pages containing Contact Form 7 forms by submitting shortcode strings in form fields, which are reflected in the rendered form HTML and then executed via do_shortcode().