CVE-2026-91010: Invisible Anti-Spam & CAPTCHA < 5.1.1 - Subscriber+ Arbitrary Form Submission Deletion
The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 does not check the user's capabilities in its message deletion AJAX action, and only tests that a nonce parameter is present rather than validating it, allowing any authenticated user, such as a subscriber, to permanently delete every form submission the Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 has stored.
Affected Software
Event History
Frequently Asked Questions
Which users could exploit this issue?
Any authenticated WordPress user could exploit it, including users with the Subscriber role. The vulnerable AJAX action does not verify that the user has an appropriate capability.
What must an attacker do to delete submissions?
The attacker needs a valid authenticated WordPress session and must invoke the plugin's message-deletion AJAX action with a nonce parameter present. The nonce is not validated, so it does not provide meaningful protection.
What is the impact of successful exploitation?
An attacker can permanently delete every form submission stored by the affected plugin. This is an integrity and availability impact on submission records.
How can I determine whether my site is affected?
A site is affected if it uses the Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin at a version earlier than 5.1.1 and allows untrusted users to authenticate, such as Subscriber accounts.