# Simple CAPTCHA with Cloudflare Turnstile <= 1.44.0 - Unauthenticated CAPTCHA Bypass via Oversized Turnstile Token

- **ID:** WPSEC-2026-1909
- **Plugin:** Simple CAPTCHA with Cloudflare Turnstile (`simple-cloudflare-turnstile`), https://wordpress.org/plugins/simple-cloudflare-turnstile/
- **Affected versions:** from 1.36.0 before 1.44.1
- **Fixed in:** 1.44.1 (Update to 1.44.1 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-636
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-29)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/simple-cloudflare-turnstile
- **Fix released:** 2026-10-28
- **Published:** 2026-10-29
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1909/

## Description

The Simple CAPTCHA with Cloudflare Turnstile plugin for WordPress is vulnerable to CAPTCHA Bypass via the Turnstile token in all versions from 1.36.0 up to, and including, 1.44.0. This is due to insufficient validation of the submitted Turnstile token: the plugin sends it to Cloudflare's siteverify endpoint even when it is longer than the 2,048-character maximum or is not text, and treats a failed verification request (a request error or a 5xx response) as a Cloudflare outage. This makes it possible for unauthenticated attackers to submit protected forms without solving Turnstile on sites where Failsafe Mode is enabled and set to 'Allow submissions'.

## References

- https://wpsec.com/vuln/WPSEC-2026-1909/
- https://plugins.svn.wordpress.org/simple-cloudflare-turnstile/tags/1.44.1/
- https://wordpress.org/plugins/simple-cloudflare-turnstile/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1909/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.