Executive brief
The Invisible Anti-Spam & CAPTCHA WordPress plugin is used to protect website forms from spam using CAPTCHA verification. A flaw in the plugin allows any authenticated user, including subscribers with minimal permissions, to permanently delete all form submissions that the plugin has stored, potentially destroying important customer data, inquiry records, or compliance documentation without authorization.
Technical details
The vulnerability is a missing authorization check (CWE-862) in an AJAX action that handles form submission deletion. The plugin only verifies the presence of a nonce parameter rather than properly validating it, and fails to check user capabilities before allowing deletion. Any authenticated user (including subscribers) can craft requests to delete arbitrary form submissions. The attack requires authentication and network access to the WordPress site, but no additional preconditions. Fixed in version 5.1.1.
Affected products
- Invisible Anti-Spam & CAPTCHA Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms before 5.1.1
Timeline
- 2026-09-15: disclosed
- 2026-09-17: advisory