CVE-2026-16146

Name of the Vulnerable Software and Affected Versions Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms versions prior to 5.2

Description This issue is a generic SQL Injection that occurs due to insufficient escaping of user-supplied parameters and a lack of sufficient preparation of the SQL query. Authenticated attackers with editor-level access or higher can append additional SQL queries to existing ones to extract sensitive information from the database via Pattern JSON Keys/Values.

Recommendations Update to a version newer than 5.1.