CVE-2026-16094 describes an SQL Injection vulnerability in the Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin. The flaw exists in the handling of the 'key' parameter, which is not properly escaped or prepared before being included in SQL queries. Authenticated attackers with editor-level access or higher can exploit this to append arbitrary SQL commands to existing queries, enabling unauthorized data extraction from the database. The vulnerability affects all plugin versions up to and including 5.1. No vendor advisory or patch information is currently provided.

An attacker with editor-level or higher privileges can exploit this vulnerability to execute arbitrary SQL commands within the database context. This can lead to unauthorized disclosure of sensitive information stored in the database. The vulnerability does not allow privilege escalation or denial of service based on the available data. The CVSS v3.1 base score is 4.9 (medium severity), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict editor-level and higher privileges to trusted users only. Avoid exposing the vulnerable parameter to untrusted input and consider implementing additional application-level input validation or web application firewall rules to detect and block SQL injection attempts targeting the 'key' parameter.