CVE-2026-16146: 
WordPress vulnerability analysis and mitigation

CVE-2026-16146 is a SQL Injection vulnerability in the "Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms" WordPress plugin (slug: gdpr-compliant-recaptcha-for-all-forms) by matthiasnordwig. It affects all versions up to and including 5.1, allowing authenticated attackers with editor-level access or above to inject additional SQL queries via Pattern JSON Keys/Values due to insufficient input escaping and improper SQL query preparation. The vulnerability was published on August 15, 2026, and assigned by Wordfence. It carries a CVSS v3.1 base score of 4.9 (Medium) (Wordfence, ENISA EUVD).

The root cause is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command — SQL Injection). The vulnerability exists in the plugin's option and message-page handling classes (class-option.php and class-message-page.php), where user-supplied Pattern JSON keys and values are insufficiently escaped before being incorporated into SQL queries. An authenticated attacker with editor-level privileges or higher can craft malicious JSON input to append additional SQL statements to existing queries, enabling data extraction from the WordPress database (Wordfence, WordPress Trac).

Successful exploitation allows an authenticated attacker to extract sensitive information from the WordPress database, including user credentials, personal data, configuration secrets, and other stored content. The impact is limited to confidentiality — integrity and availability are not directly affected by this vulnerability. Because editor-level access is required, the attack surface is constrained to users with elevated WordPress roles, reducing but not eliminating risk, particularly in multi-author or multi-editor environments (Wordfence, ENISA EUVD).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at the editor level or above, which significantly limits opportunistic exploitation (ENISA EUVD, Wordfence).

1. Reconnaissance: Identify WordPress sites running the "Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms" plugin (slug: gdpr-compliant-recaptcha-for-all-forms) at version 5.1 or below using tools like WPScan or by inspecting plugin directories.
2. Obtain Editor-Level Access: Authenticate to the WordPress site with an account holding editor-level privileges or higher (e.g., via compromised credentials, phishing, or a separate vulnerability).
3. Identify Vulnerable Input: Navigate to the plugin's admin settings or pattern management interface where JSON-based pattern keys/values are accepted as input (corresponding to class-option.php and class-message-page.php).
4. Craft Malicious Payload: Construct a JSON payload with SQL injection syntax embedded in the pattern keys or values (e.g., {"pattern_key' UNION SELECT user_login,user_pass FROM wp_users-- -": "value"}) to append a secondary SQL query.
5. Submit and Extract Data: Submit the crafted payload through the plugin's interface. The insufficient escaping causes the injected SQL to execute, returning sensitive database contents (e.g., WordPress user hashes) in the application response or via error messages (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing authenticated POST requests to plugin admin pages (e.g., wp-admin/admin.php?page=gdpr-compliant-recaptcha*) containing JSON payloads with SQL syntax such as UNION SELECT, --, or OR 1=1.
• Database: Unexpected or anomalous database query logs (if MySQL general query log is enabled) showing appended SQL statements originating from the plugin's query context.
• File System: No direct file-system artifacts expected for this SQL injection type; however, monitor for new admin accounts or modified user records in the wp_users table as a downstream indicator of credential theft.
• Application Behavior: Unusual error messages or unexpected data returned in plugin admin pages that may reflect SQL query output leakage.

Users should update the "Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms" plugin to a version beyond 5.1 once a patched release is available (changeset 3633500 has been committed to the WordPress plugin repository). Until a patched version is confirmed available, administrators should restrict editor-level and above access to trusted users only, and consider temporarily deactivating the plugin on sensitive sites. Monitoring WordPress admin activity and database query logs for anomalous SQL patterns is also recommended as a compensating control (WordPress Trac Changeset, Wordfence).