Vulnerabilities / Simple CAPTCHA with Cloudflare Turnstile / WPSEC-2026-2113
Simple CAPTCHA with Cloudflare Turnstile <= 1.44.1 - Unauthenticated CAPTCHA Bypass via WordPress Registration Form
Low 3.7
CWE-693Fixed in 1.44.2
- ID
- WPSEC-2026-2113
- Plugin
- Simple CAPTCHA with Cloudflare Turnstile (simple-cloudflare-turnstile)
- Affected
- all versions before 1.44.2
- Remediation
- Update to 1.44.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-693
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-30
- Attack surface
- Simple CAPTCHA with Cloudflare Turnstile on WPSec AttackSurface
- Fix released
- Published
Description
The Simple CAPTCHA with Cloudflare Turnstile plugin for WordPress is vulnerable to a CAPTCHA bypass on the WordPress registration form in all versions up to, and including, 1.44.1. The registration check skipped Turnstile verification whenever a request carried a valid WooCommerce or Easy Digital Downloads registration nonce, and these nonces are publicly exposed on those plugins' registration forms. On sites running WooCommerce or Easy Digital Downloads, this makes it possible for unauthenticated attackers to register accounts automatically without solving the Turnstile challenge.
References
- https://wpsec.com/vuln/WPSEC-2026-2113/
- https://plugins.svn.wordpress.org/simple-cloudflare-turnstile/tags/1.44.2/
- https://wordpress.org/plugins/simple-cloudflare-turnstile/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS