Simple CAPTCHA with Cloudflare Turnstile <= 1.44.0 - Unauthenticated CAPTCHA Bypass via Oversized Turnstile Token
- ID
- WPSEC-2026-1909
- Plugin
- Simple CAPTCHA with Cloudflare Turnstile (simple-cloudflare-turnstile)
- Affected
- from 1.36.0 before 1.44.1
- Remediation
- Update to 1.44.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-636
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-29
- Attack surface
- Simple CAPTCHA with Cloudflare Turnstile on WPSec AttackSurface
- Fix released
- Published
Description
The Simple CAPTCHA with Cloudflare Turnstile plugin for WordPress is vulnerable to CAPTCHA Bypass via the Turnstile token in all versions from 1.36.0 up to, and including, 1.44.0. This is due to insufficient validation of the submitted Turnstile token: the plugin sends it to Cloudflare's siteverify endpoint even when it is longer than the 2,048-character maximum or is not text, and treats a failed verification request (a request error or a 5xx response) as a Cloudflare outage. This makes it possible for unauthenticated attackers to submit protected forms without solving Turnstile on sites where Failsafe Mode is enabled and set to 'Allow submissions'.
References
- https://wpsec.com/vuln/WPSEC-2026-1909/
- https://plugins.svn.wordpress.org/simple-cloudflare-turnstile/tags/1.44.1/
- https://wordpress.org/plugins/simple-cloudflare-turnstile/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS