{
 "id": "WPSEC-2026-2129",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2129/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2129/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2129/index.md",
 "title": "Invisible Anti-Spam & CAPTCHA <= 6.2.0 - Unauthenticated Spam Protection Bypass via PUT/PATCH REST Requests",
 "description": "The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to a protection mechanism bypass via PUT/PATCH REST requests in all versions from 5.3.0 up to, and including, 6.2.0. This is due to the REST route check only evaluating requests dispatched as POST, and to the plugin not reading the body of PUT or PATCH requests. Monitored form submission routes registered as editable, such as those of SureForms and Crowdsignal Forms, also accept PUT and PATCH. This makes it possible for unauthenticated attackers to submit these forms without a proof-of-work token and without any spam or blocklist evaluation by sending the submission as a PUT or PATCH request, bypassing the anti-spam protection the site owner enabled.",
 "plugin": {
  "slug": "gdpr-compliant-recaptcha-for-all-forms",
  "name": "Invisible Anti-Spam & CAPTCHA",
  "full_name": "Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms",
  "wordpress_org": "https://wordpress.org/plugins/gdpr-compliant-recaptcha-for-all-forms/",
  "advisories_url": "https://wpsec.com/vuln/plugin/gdpr-compliant-recaptcha-for-all-forms/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/gdpr-compliant-recaptcha-for-all-forms"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-693"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "5.3.0",
    "from_inclusive": true,
    "to": "6.3.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 5.3.0 before 6.3.0"
  ]
 },
 "introduced_in": "5.3.0",
 "fixed_in": "6.3.0",
 "remediation": "Update to 6.3.0 or later.",
 "fix_released": "2026-10-29T17:14:15+00:00",
 "published": "2026-10-30T17:44:03+00:00",
 "updated": "2026-10-30T09:24:43.716341+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2129/",
  "https://plugins.svn.wordpress.org/gdpr-compliant-recaptcha-for-all-forms/tags/6.3.0/",
  "https://wordpress.org/plugins/gdpr-compliant-recaptcha-for-all-forms/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/gdpr-compliant-recaptcha-for-all-forms",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-30"
 }
}