What is the CVSS score of EUVD-2026-58862?

EUVD-2026-58862 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Invisible Anti-Spam Captcha EUVD-2026-58862

| CVE-2026-16146 MEDIUM

SQL Injection (CWE-89)

2026-08-15 Wordfence

GHSA-xxj3-7fh5-vvxc

WordPress SQLi Wordpress Plugin Invisible Anti Spam Captcha Recaptcha Alternative For All Forms Matthiasnordwig

4.9

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

4.9 MEDIUM

Network vector confirmed for WordPress admin panel access; PR:H reflects mandatory editor-level authentication; I:N and A:N because injection is append-only SELECT with no write or destructive capability.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 15, 2026 - 04:05 vuln.today

CVE Published

Aug 15, 2026 - 03:25 cve.org

MEDIUM 4.9

DescriptionCVE.org

The Invisible Anti-Spam & CAPTCHA - reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to generic SQL Injection via Pattern JSON Keys/Values in all versions up to, and including, 5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

AnalysisAI

SQL Injection in the 'Invisible Anti-Spam & CAPTCHA - reCAPTCHA Alternative for All Forms' WordPress plugin (all versions through 5.1) permits authenticated users holding editor-level or higher WordPress roles to append arbitrary SQL clauses to existing database queries via unsanitized Pattern JSON keys and values. The attack yields full read access to the WordPress database - including user credentials, PII, and configuration data - while carrying no integrity or availability impact per the CVSS vector (I:N, A:N). No public exploit code has been identified and the vulnerability does not appear in the CISA KEV catalog at time of analysis.

Technical ContextAI

The vulnerability resides in two PHP classes within the plugin: class-option.php (lines 290-292) and class-message-page.php (lines 428, 451, 519), both visible in the version 5.0 tag on WordPress plugin trac. The root cause is CWE-89 - Improper Neutralization of Special Elements in SQL Commands - where user-supplied data from Pattern JSON keys and values is interpolated directly into SQL queries without adequate escaping or use of WordPress's wpdb::prepare() parameterization mechanism. The CPE string cpe:2.3:a:matthiasnordwig:invisible_anti-spam_&_captcha_-_recaptcha_alternative_for_all_forms:*:*:*:*:*:*:*:* identifies the author as matthiasnordwig and the plugin repository slug as gdpr-compliant-recaptcha-for-all-forms. The injection class is append-style, enabling additional SELECT subqueries to be chained onto existing database calls, which restricts exploitation to data read-out rather than data modification or deletion.

RemediationAI

Administrators should update the plugin beyond version 5.1 through the WordPress plugin dashboard as soon as a patched release becomes available. A fix is traceable to WordPress plugin trac changeset 3633500 (https://plugins.trac.wordpress.org/changeset/3633500/gdpr-compliant-recaptcha-for-all-forms), but no independently confirmed patched release version number is present in the available data - treat this as an upstream fix pending a tagged release. Until a patched version is confirmed installed, operators should audit and minimize the set of accounts holding editor-level or higher WordPress roles, and revoke or rotate credentials for any accounts whose access cannot be verified. Disabling the plugin entirely removes the attack surface with the trade-off of losing anti-spam and CAPTCHA protection across all site forms. Enabling MySQL or MariaDB query logging, or deploying a WordPress activity-log plugin, can help detect anomalous SELECT operations targeting sensitive tables such as wp_users. A perimeter WAF is unlikely to block this reliably, as the payload targets admin-side JSON parameter structures rather than typical reflected injection points.