# Invisible Anti-Spam & CAPTCHA <= 6.2.0 - Unauthenticated Spam Protection Bypass via PUT/PATCH REST Requests

- **ID:** WPSEC-2026-2129
- **Plugin:** Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms (`gdpr-compliant-recaptcha-for-all-forms`), https://wordpress.org/plugins/gdpr-compliant-recaptcha-for-all-forms/
- **Affected versions:** from 5.3.0 before 6.3.0
- **Fixed in:** 6.3.0 (Update to 6.3.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-693
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/gdpr-compliant-recaptcha-for-all-forms
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2129/

## Description

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to a protection mechanism bypass via PUT/PATCH REST requests in all versions from 5.3.0 up to, and including, 6.2.0. This is due to the REST route check only evaluating requests dispatched as POST, and to the plugin not reading the body of PUT or PATCH requests. Monitored form submission routes registered as editable, such as those of SureForms and Crowdsignal Forms, also accept PUT and PATCH. This makes it possible for unauthenticated attackers to submit these forms without a proof-of-work token and without any spam or blocklist evaluation by sending the submission as a PUT or PATCH request, bypassing the anti-spam protection the site owner enabled.

## References

- https://wpsec.com/vuln/WPSEC-2026-2129/
- https://plugins.svn.wordpress.org/gdpr-compliant-recaptcha-for-all-forms/tags/6.3.0/
- https://wordpress.org/plugins/gdpr-compliant-recaptcha-for-all-forms/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2129/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.