CVE-2026-16146 matthiasnordwig CVE debrief

Who should care

Administrators of WordPress installations using the Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin, version up to and including 5.1, should be aware of this vulnerability and take necessary actions to protect their installations.

Technical summary

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to generic SQL Injection via Pattern JSON Keys/Values in all versions up to, and including, 5.1. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. An authenticated attacker with editor-level access and above could exploit this vulnerability to append additional SQL queries into existing queries, potentially extracting sensitive information from the database.

Defensive priority

Authenticated attackers with editor-level access and above could exploit this vulnerability to append additional SQL queries into existing queries, potentially extracting sensitive information from the database.

Recommended defensive actions

• Inventory and verify the version of the Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress.
• Restrict access to the plugin's functionality to prevent authenticated attackers with editor-level access and above from exploiting the vulnerability.
• Implement additional monitoring to detect potential SQL injection attempts.
• Apply the vendor's remediation as soon as it becomes available.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability was reported by [email protected]. The affected plugin is Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms, version up to and including 5.1. Evidence is limited to reporter claims and CVE details. Defenders should verify the existence of affected product deployments, review official advisories, and plan for vendor-supported updates or mitigations. Additional monitoring may be necessary to detect potential SQL injection attempts.

Official resources