The Invisible Anti‑Spam & CAPTCHA plugin is vulnerable to a generic SQL injection through Pattern JSON keys and values. Because user supplied parameters are not properly escaped and the existing SQL query is not sufficiently prepared, authenticated attackers with editor‑level or higher permissions can inject additional SQL that is executed alongside the legitimate query. This flaw, a CWE‑89 (SQL Injection), can be leveraged to read arbitrary data from the database, exposing sensitive information.

WordPress installations that use the Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin by Matthias Nordwig. All released versions up to and including 5.1 are affected; later versions may have the fix, but the exact fixed release is not specified.

The CVSS score of 4.9 indicates a moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting a lower likelihood of widespread exploitation. However, because only authenticated users with editor privileges can exploit the flaw, organizations with broad editor access may be at higher risk. The typical attack vector is via the WordPress admin interface where an attacker logs in with editor rights, then submits a crafted form that contains malicious JSON to trigger the injection.