Executive brief
The Invisible Anti-Spam & CAPTCHA plugin for WordPress contains a SQL injection vulnerability that allows authenticated editors and administrators to extract sensitive information from the website's database. An attacker with editor-level or higher access can inject malicious SQL code through form pattern JSON fields, exposing customer data, user credentials, and other confidential database contents.
Technical details
This vulnerability is a generic SQL injection flaw in the plugin's form pattern handling functionality, affecting all versions up to and including 5.1. The vulnerable code fails to properly escape user-supplied input and lacks sufficient parameterized query preparation in the SQL statement handling. The attack requires authenticated access with editor-level privileges or above, making it a post-authentication vulnerability. An attacker can craft malicious JSON values in the Pattern field to inject arbitrary SQL queries and extract sensitive information from the WordPress database. A patch or update addressing the insufficient escaping and query preparation is expected from the plugin developers.
Affected products
- Invisible Anti-Spam & CAPTCHA reCAPTCHA Alternative for All Forms up to and including 5.1
Timeline
- 2026-08-15: disclosed