Executive brief
The Invisible Anti-Spam & CAPTCHA plugin for WordPress contains a SQL injection vulnerability affecting versions up to 5.1. Authenticated users with editor-level access or higher can inject malicious SQL code through the 'key' parameter to extract sensitive database information, potentially exposing user data and site configuration details.
Technical details
The vulnerability is a generic SQL injection flaw in the 'key' parameter caused by insufficient escaping of user-supplied input and lack of parameterized query preparation. The vulnerable component is located in the message page handler (class-message-page.php). The attack requires network access and authenticated user credentials at editor level or above; no additional user interaction is needed. An authenticated attacker can append arbitrary SQL queries to extract sensitive database records, including user credentials, configuration, and other stored data. A patch addressing the SQL injection through proper escaping and prepared statements should be available in version 5.2 or later.
Affected products
- Titus Sija The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms up to and including 5.1
Timeline
- 2026-08-15: disclosed: CVE-2026-16094 published on NVD
- 2026-08-15: other: Vulnerability affects versions up to 5.1