CVE-2026-16094 matthiasnordwig CVE debrief

Who should care

Administrators and users of WordPress sites utilizing the Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin, especially those with editor-level access and above, should be aware of this vulnerability and take necessary precautions.

Technical summary

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to generic SQL Injection via the 'key' parameter in all versions up to, and including, 5.1. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Authenticated attackers with editor-level access and above can exploit this to append additional SQL queries into existing queries, potentially extracting sensitive information from the database.

Defensive priority

Authenticated attackers with editor-level access and above could exploit this vulnerability to append additional SQL queries into existing queries, potentially extracting sensitive information from the database.

Recommended defensive actions

• Inventory and verify the version of the Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress.
• Restrict access to the plugin's settings and sensitive data.
• Implement additional monitoring for suspicious database queries.
• Consider applying vendor patches or updates as they become available.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability was reported by [email protected]. The affected plugin is Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms for WordPress, up to and including version 5.1. Evidence is limited to reporter claims and CVE details. Defenders should verify the existence of affected product deployments and review official advisories for validation.

Official resources