# Nexter Extension <= 4.7.12 - Unauthenticated CAPTCHA Bypass via Missing Cloudflare Turnstile Token

- **ID:** WPSEC-2026-1082
- **Plugin:** Nexter Extension – Security, Performance, Code Snippets & Site Toolkit (`nexter-extension`), https://wordpress.org/plugins/nexter-extension/
- **Affected versions:** all versions before 4.7.13
- **Fixed in:** 4.7.13 (Update to 4.7.13 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-693
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-16)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/nexter-extension
- **Fix released:** 2026-10-15
- **Published:** 2026-10-16
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1082/

## Description

The Nexter Extension plugin for WordPress is vulnerable to a CAPTCHA bypass in all versions up to, and including, 4.7.12. This is due to the Cloudflare Turnstile checks on the login, registration, password reset and comment forms skipping verification when the request has no cf-turnstile-response value, so they rejected only submissions with an invalid token. This makes it possible for unauthenticated attackers to get past the Turnstile protection on these forms when the site owner has turned it on, which allows automated login attempts, spam registrations and comment spam.

## References

- https://wpsec.com/vuln/WPSEC-2026-1082/
- https://plugins.svn.wordpress.org/nexter-extension/tags/4.7.13/
- https://wordpress.org/plugins/nexter-extension/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1082/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.