Description

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to generic SQL Injection via the 'key' parameter in all versions up to, and including, 5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-08-15T04:18:09.987Z",
  "pubdate": "2026-08-15T04:18:09.987Z",
  "executiveSummary": "An SQL injection vulnerability exists in the Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress in all versions up to, and including, 5.1. The flaw resides in the handling of the 'key' parameter, which suffers from insufficient escaping of user-supplied input and a lack of proper query preparation.\nThis vulnerability allows authenticated attackers with editor-level access and above to manipulate existing SQL queries executed by the application. By successfully injecting malicious SQL syntax through the vulnerable parameter, an attacker can append arbitrary SQL queries to the original database statement.\nThe primary impact of this security deficiency is unauthorized data extraction, potentially exposing sensitive information stored within the WordPress database. Exploitation requires authenticated access with specific privilege levels, specifically editor-level access or higher, limiting the threat vector to internal malicious actors or compromised high-privileged accounts.\nThe risk implication is significant database exposure, as successful exploitation bypasses intended application logic to query backend data directly. Remediation requires proper input sanitization, parameterization, and strict adherence to secure coding practices when interacting with the database.",
  "technicalDetails": "The vulnerability is classified as a generic SQL Injection (SQLi) flaw affecting the Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress across all versions up to, and including, 5.1.\nThe vulnerable component is the parameter handling mechanism associated with the 'key' parameter. The root cause stems from insufficient escaping of user-supplied input combined with a lack of sufficient preparation on the existing SQL query before database execution.\nAuthentication and privilege requirements dictate that an attacker must possess authenticated access with editor-level privileges or above to reach the vulnerable code path and supply the malicious input.\nThe attack flow proceeds as follows: First, the authenticated attacker crafts a malicious payload containing SQL command fragments designed to manipulate the intended query structure. Second, the attacker transmits this payload via the 'key' parameter to the vulnerable endpoint. Third, because the input lacks proper escaping and the query is not adequately prepared, the database management system interprets the user-supplied input as executable SQL commands rather than literal data. Finally, the injected query executes alongside or appended to the original query.\nThe payload behavior involves breaking out of the intended query context, allowing the attacker to execute secondary SQL statements. This facilitates UNION-based or error-based extraction techniques depending on the database context.\nThe post-exploitation impact includes the potential extraction of sensitive database information, such as user credentials, configuration settings, or other proprietary data stored within the WordPress database tables."
}