CVE-2026-16146 in Invisible Anti-Spam & CAPTCHA Plugin
Summary
by MITRE • 08/15/2026
The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to generic SQL Injection via Pattern JSON Keys/Values in all versions up to, and including, 5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability exists within the Invisible Anti-Spam & CAPTCHA reCAPTCHA Alternative for All Forms plugin for WordPress, affecting all versions up to and including 5.1. The flaw represents a classic SQL injection weakness that stems from inadequate input sanitization and improper query preparation mechanisms. Attackers with editor-level privileges or higher can exploit this vulnerability to manipulate database queries through manipulated JSON key-value pairs within pattern parameters, effectively bypassing the intended security controls.
The technical implementation of this vulnerability occurs when the plugin processes user-supplied JSON data containing pattern configurations without adequate escaping or parameterization. This creates an environment where malicious actors can inject additional SQL commands into existing database queries through carefully crafted input that gets directly incorporated into the SQL execution string. The vulnerability specifically targets the handling of JSON keys and values within pattern parameters, which are processed without proper sanitization before being executed against the WordPress database.
Authenticated attackers with editor privileges or higher can leverage this vulnerability to extract sensitive information from the underlying database through the injected SQL commands. This includes but is not limited to user credentials, personal information, configuration data, and potentially administrative access tokens. The impact extends beyond simple data extraction as attackers could potentially modify database contents or escalate their privileges within the WordPress environment, making this a critical security concern for affected installations.
Organizations should immediately update to versions beyond 5.1 of the plugin to address this vulnerability, as no patches are available for the affected versions. System administrators should also implement network-level monitoring to detect suspicious SQL query patterns and consider implementing web application firewalls to help mitigate potential exploitation attempts. Additional mitigations include restricting WordPress user privileges to the minimum required levels, regularly auditing user accounts with elevated permissions, and conducting thorough security assessments of all installed plugins to identify similar vulnerabilities.
This vulnerability aligns with CWE-89 which defines SQL injection as the insertion of malicious SQL code into a query through untrusted input. The attack vector follows patterns described in the MITRE ATT&CK framework under T1078 for valid accounts and T1566 for credential access, as attackers leverage legitimate administrative privileges to execute malicious database operations. The specific nature of this vulnerability demonstrates how insufficient input validation in form processing components can create persistent backdoors for data exfiltration attacks, making it a significant concern for WordPress security posture management.