Description

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to generic SQL Injection via Pattern JSON Keys/Values in all versions up to, and including, 5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-08-15T04:18:10.440Z",
  "pubdate": "2026-08-15T04:18:10.440Z",
  "executiveSummary": "The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is susceptible to a generic SQL Injection vulnerability affecting all versions up to, and including, 5.1.\nThe security flaw stems from inadequate escaping applied to user-supplied parameters combined with a lack of proper query preparation within the database interaction layer.\nAuthenticated malicious actors possessing editor-level privileges or higher can exploit this vulnerability by manipulating Pattern JSON Keys and Values.\nSuccessful exploitation enables attackers to append arbitrary SQL commands to pre-existing database queries, facilitating unauthorized database enumeration and the extraction of sensitive information.\nThis vulnerability poses a significant risk to data confidentiality and integrity, potentially exposing critical application and user data stored within the WordPress database to privileged threat actors.",
  "technicalDetails": "The vulnerability resides in the handling of Pattern JSON Keys/Values within the Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress.\nThe root cause of the issue is insufficient escaping of user-supplied input and the absence of parameterized queries or proper query preparation mechanisms when constructing database statements.\nThe vulnerable component processes input data derived from Pattern JSON Keys and Values, subsequently incorporating these values directly into database queries without adequate sanitization.\nAffected software versions include all iterations up to, and including, version 5.1 of the plugin.\nExploitation of this vulnerability requires authenticated access with editor-level privileges or higher within the WordPress installation.\nThe attack flow proceeds as follows: an attacker with the requisite privileges crafts a malicious payload targeting the Pattern JSON Keys or Values parameter.\nBecause the input is insufficiently escaped and improperly prepared, the malicious input breaks out of the intended query context and allows the injection of arbitrary SQL syntax.\nThe database management system executes the appended SQL commands alongside the legitimate query logic, returning unauthorized query results back to the application.\nPost-exploitation impact includes the potential extraction of sensitive database contents, such as user credentials, configuration data, and other confidential records accessible via the database connection."
}