CVE-2013-4272: The BOTCHA Spam Prevention module 7.x-1.x before 7.x-1.6, 7.x-2.x before 7.x-2.1, and 7.x-3.x before 7.x-3....

Security readout for executives and security teams

A Drupal BOTCHA Spam Prevention module flaw can expose submitted form contents in logs when high debugging is enabled. Those form contents may include usernames and passwords. The issue matters most for sites using affected BOTCHA versions with debugging level 5 or 6 and where users can read the relevant log files. Exposure is configuration-dependent. Drupal sites running the affected BOTCHA module versions are at risk only if debugging is set to level 5 or 6 and log files are readable by users who should not see submitted form data. Prioritize if the organization still operates legacy Drupal 7 sites using BOTCHA. The business risk is credential or personal-data exposure through logs, not direct system takeover. Remediation should be quick if the module can be updated and debugging reduced. Mitigation focus: Upgrade BOTCHA to 7.x-1.6, 7.x-2.1, or 7.x-3.3 as applicable.; Disable high debugging levels, especially levels 5 and 6.; Restrict access to application and Drupal log files..

Prepared

Jun 14, 2026, 16:20 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.