Invisible Anti-Spam & CAPTCHA <= 6.2.0 - Unauthenticated Spam Protection Bypass via PUT/PATCH REST Requests
- ID
- WPSEC-2026-2129
- Plugin
- Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms (gdpr-compliant-recaptcha-for-all-forms)
- Affected
- from 5.3.0 before 6.3.0
- Remediation
- Update to 6.3.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-693
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-30
- Attack surface
- Invisible Anti-Spam & CAPTCHA on WPSec AttackSurface
- Fix released
- Published
Description
The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to a protection mechanism bypass via PUT/PATCH REST requests in all versions from 5.3.0 up to, and including, 6.2.0. This is due to the REST route check only evaluating requests dispatched as POST, and to the plugin not reading the body of PUT or PATCH requests. Monitored form submission routes registered as editable, such as those of SureForms and Crowdsignal Forms, also accept PUT and PATCH. This makes it possible for unauthenticated attackers to submit these forms without a proof-of-work token and without any spam or blocklist evaluation by sending the submission as a PUT or PATCH request, bypassing the anti-spam protection the site owner enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-2129/
- https://plugins.svn.wordpress.org/gdpr-compliant-recaptcha-for-all-forms/tags/6.3.0/
- https://wordpress.org/plugins/gdpr-compliant-recaptcha-for-all-forms/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS