CVE-2026-91010

Name of the Vulnerable Software and Affected Versions Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin versions prior to 5.1.1

Description An issue exists in the message deletion AJAX action where the software fails to verify user capabilities and only checks for the presence of a nonce parameter without validating it. This allows any authenticated user, including those with subscriber-level privileges, to permanently delete all stored form submissions.

Recommendations Update to version 5.1.1 or later.