{"id":"CVE-2026-91010","title":"The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 does not check the user's capabilities in its message deletion AJAX action, and only tests that a nonce parameter is present rather tha…","summary":"The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 does not check the user's capabilities in its message deletion AJAX action, and only tests that a nonce parameter is present rather tha…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cwe":["CWE-862"],"product":"Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms","affected":["invisible_anti-spam_captcha_recaptcha_alternative_for_all_forms >= 2.0.5 < 5.1.1"],"published":"2026-09-17","updated":"2026-09-18","sourceUpdated":"2026-09-18T19:08:32.830","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91010","references":[{"url":"https://wpscan.com/vulnerability/08860091-c3e4-43f1-b2e2-82fb8d45a5fa/","label":"contact@wpscan.com"}],"tags":["nvd","cve.org"],"epss":0.00152,"epssPercentile":0.04732,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-17T12:10:50.936743Z"},"ingestedAt":"2026-09-17T06:12:17.971Z","slug":"CVE-2026-91010","body":"## Overview\n\nThe Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 does not check the user's capabilities in its message deletion AJAX action, and only tests that a nonce parameter is present rather than validating it, allowing any authenticated user, such as a subscriber, to permanently delete every form submission the Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 has stored.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":206071,"id":"CVE-2026-91010","ts":1789651153085,"field":"cvss","old":null,"new":"4.3"},{"seq":206070,"id":"CVE-2026-91010","ts":1789651153085,"field":"severity","old":"none","new":"medium"}]}