Simple CAPTCHA with Cloudflare Turnstile <= 1.44.1 - Unauthenticated CAPTCHA Bypass via Clean Login Registration Form

ID

WPSEC-2026-2114

Plugin

Simple CAPTCHA with Cloudflare Turnstile (simple-cloudflare-turnstile)

Affected

from 1.25.0 before 1.44.2

Remediation

Update to 1.44.2 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness

CWE-693

Usage

Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-30

Attack surface

Simple CAPTCHA with Cloudflare Turnstile on WPSec AttackSurface

Fix released

2026-10-29

Published

2026-10-30

Description

The Simple CAPTCHA with Cloudflare Turnstile plugin for WordPress is vulnerable to a CAPTCHA bypass on the Clean Login registration form in all versions up to, and including, 1.44.1. The plugin displayed a Turnstile widget on the Clean Login registration form but never verified the response on the server. Clean Login creates users directly, so the WordPress registration check never ran. On sites using the Clean Login integration, this makes it possible for unauthenticated attackers to register accounts automatically without passing the Turnstile challenge.

References

• https://wpsec.com/vuln/WPSEC-2026-2114/
• https://plugins.svn.wordpress.org/simple-cloudflare-turnstile/tags/1.44.2/
• https://wordpress.org/plugins/simple-cloudflare-turnstile/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS