WordPress security by component
Invisible Anti-Spam & CAPTCHA
Invisible Anti-Spam & CAPTCHA (invisible-anti-spam-captcha-recaptcha-alternative-for-all-forms) is a WordPress plugin with 1 published CVE record in this archive. The latest tracked vulnerability was published Sep 17, 2026; the highest published CVSS base score is 4.3.
Plugin slug:
invisible-anti-spam-captcha-recaptcha-alternative-for-all-formsLatest vulnerability
CVE-2026-91010: Invisible Anti-Spam lets subscribers permanently delete stored submissions
Invisible Anti-Spam & CAPTCHA from 2.0.5 up to but not including 5.1.1, any logged-in user, including a Subscriber, can invoke the message-deletion AJAX operation without a capability check. The handler checks only that a nonce parameter exists rather than validating its value. This permits permanent deletion of every stored form submission. The export does not name the action, nonce field or deletion selector.
| Safe version |
|
||
|---|---|---|---|
| Sep 17, 2026 |
CVE-2026-91010
Invisible Anti-Spam lets subscribers permanently delete stored submissions
Invisible Anti-Spam & CAPTCHA from 2.0.5 up to but not including 5.1.1, any logged-in user, including a Subscriber, can invoke the message-deletion AJAX operation without a capability check. The handler checks only that a nonce parameter exists rather than validating its value. This permits permanent deletion of every stored form submission. The export does not name the action, nonce field or deletion selector.
|
5.1.1 |
CVE4.3
|