# Simple CAPTCHA with Cloudflare Turnstile <= 1.44.1 - Unauthenticated CAPTCHA Bypass via WordPress Registration Form

- **ID:** WPSEC-2026-2113
- **Plugin:** Simple CAPTCHA with Cloudflare Turnstile (`simple-cloudflare-turnstile`), https://wordpress.org/plugins/simple-cloudflare-turnstile/
- **Affected versions:** all versions before 1.44.2
- **Fixed in:** 1.44.2 (Update to 1.44.2 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-693
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/simple-cloudflare-turnstile
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2113/

## Description

The Simple CAPTCHA with Cloudflare Turnstile plugin for WordPress is vulnerable to a CAPTCHA bypass on the WordPress registration form in all versions up to, and including, 1.44.1. The registration check skipped Turnstile verification whenever a request carried a valid WooCommerce or Easy Digital Downloads registration nonce, and these nonces are publicly exposed on those plugins' registration forms. On sites running WooCommerce or Easy Digital Downloads, this makes it possible for unauthenticated attackers to register accounts automatically without solving the Turnstile challenge.

## References

- https://wpsec.com/vuln/WPSEC-2026-2113/
- https://plugins.svn.wordpress.org/simple-cloudflare-turnstile/tags/1.44.2/
- https://wordpress.org/plugins/simple-cloudflare-turnstile/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2113/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.