CVE-2026-91010: WordPress Anti-Spam Plugin Auth Bypass

CVE-2026-91010 Overview

CVE-2026-91010 is a broken access control vulnerability in the Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before version 5.1.1. The plugin exposes an AJAX action for deleting stored form submission messages without verifying user capabilities. The handler only checks whether a nonce parameter is present rather than validating its value. Any authenticated user, including a low-privilege subscriber, can invoke the action and permanently delete every form submission stored by the plugin. The flaw is tracked under CWE-862: Missing Authorization.

Critical Impact
Authenticated subscribers can permanently destroy all stored form submissions, causing irreversible loss of contact, lead, and inquiry data collected through site forms.

Affected Products

Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin versions prior to 5.1.1
WordPress sites using the plugin to collect and store form submissions
Any site configuration allowing user registration at the subscriber role or higher

Discovery Timeline

2026-09-17 - CVE-2026-91010 published to the National Vulnerability Database
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-91010

Vulnerability Analysis

The plugin registers an AJAX endpoint to delete stored form submission messages. The handler is reachable through the standard wp-admin/admin-ajax.php interface available to all authenticated users. Two required security controls are missing or incorrectly implemented in the endpoint.

First, the handler does not call a capability check such as current_user_can() before executing the deletion. Second, the nonce check uses a presence test on the request parameter instead of wp_verify_nonce() or check_ajax_referer(). Because any non-empty string satisfies the presence test, the CSRF protection provides no security benefit.

The combined effect is that authenticated users of any role can trigger the deletion routine and remove every stored submission record. The vulnerability requires authentication but does not require administrative privileges, elevated roles, or user interaction from another user.

Root Cause

The root cause is Missing Authorization [CWE-862]. The developer relied on nonce presence as an authentication proxy and did not enforce role-based access on a destructive administrative action. Nonces are designed to prevent CSRF, not to authorize actions, and they must be validated with a verification function rather than checked for existence.

Attack Vector

An attacker registers or logs in as a subscriber on a vulnerable WordPress site. The attacker sends a crafted POST request to admin-ajax.php specifying the plugin's message deletion action and includes any arbitrary value for the nonce parameter. The server processes the request and deletes all stored form submissions without further checks. The attack requires only network access to the site and valid subscriber credentials.

See the WPScan Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-91010

Indicators of Compromise

Unexpected drop to zero in the plugin's stored form submissions table without administrator action
POST requests to /wp-admin/admin-ajax.php referencing the plugin's message deletion action from non-administrator sessions
Access log entries showing subscriber-level accounts invoking administrative AJAX actions
Database rows for form submissions missing after a period of normal collection activity

Detection Strategies

Monitor web server access logs for POST requests to admin-ajax.php where the action parameter matches the plugin's deletion handler and the requesting user is not an administrator
Compare current stored submission counts against historical baselines to identify mass-deletion events
Audit WordPress user role assignments and flag anomalous subscriber account creation preceding admin-ajax calls to the plugin

Monitoring Recommendations

Enable WordPress audit logging plugins to capture AJAX action invocations, user identity, and timestamps
Forward web server and WordPress application logs to a centralized SIEM for correlation of authentication, registration, and AJAX activity
Alert on any successful admin-ajax action referencing the plugin from accounts below the editor role

How to Mitigate CVE-2026-91010

Immediate Actions Required

Upgrade the Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin to version 5.1.1 or later
Back up the plugin's stored form submissions database table before applying updates or performing recovery
Review the WordPress user list and disable or remove untrusted subscriber accounts
Disable open user registration if it is not required for site functionality

Patch Information

The vendor addressed the issue in version 5.1.1 of the plugin. Site administrators should update through the WordPress plugin dashboard or by downloading the fixed release from the WordPress plugin repository. Refer to the WPScan Vulnerability Report for details on the fix.

Workarounds

Deactivate the plugin until the patched version can be installed and validated
Restrict access to wp-admin/admin-ajax.php at the web server or WAF layer for non-administrator sessions where feasible
Set users_can_register to false in WordPress general settings to prevent unauthenticated attackers from obtaining subscriber accounts
Export and archive stored form submissions regularly so that a deletion event does not result in permanent data loss

bash

# Disable open user registration via WP-CLI
wp option update users_can_register 0

# Verify installed plugin version
wp plugin get invisible-captcha-recaptcha-alternative --field=version

# Update the plugin to the patched release
wp plugin update invisible-captcha-recaptcha-alternative --version=5.1.1