{
 "id": "WPSEC-2026-2114",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2114/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2114/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2114/index.md",
 "title": "Simple CAPTCHA with Cloudflare Turnstile <= 1.44.1 - Unauthenticated CAPTCHA Bypass via Clean Login Registration Form",
 "description": "The Simple CAPTCHA with Cloudflare Turnstile plugin for WordPress is vulnerable to a CAPTCHA bypass on the Clean Login registration form in all versions up to, and including, 1.44.1. The plugin displayed a Turnstile widget on the Clean Login registration form but never verified the response on the server. Clean Login creates users directly, so the WordPress registration check never ran. On sites using the Clean Login integration, this makes it possible for unauthenticated attackers to register accounts automatically without passing the Turnstile challenge.",
 "plugin": {
  "slug": "simple-cloudflare-turnstile",
  "name": "Simple CAPTCHA with Cloudflare Turnstile",
  "full_name": "Simple CAPTCHA with Cloudflare Turnstile",
  "wordpress_org": "https://wordpress.org/plugins/simple-cloudflare-turnstile/",
  "advisories_url": "https://wpsec.com/vuln/plugin/simple-cloudflare-turnstile/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/simple-cloudflare-turnstile"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-693"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "1.25.0",
    "from_inclusive": true,
    "to": "1.44.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 1.25.0 before 1.44.2"
  ]
 },
 "introduced_in": "1.25.0",
 "fixed_in": "1.44.2",
 "remediation": "Update to 1.44.2 or later.",
 "fix_released": "2026-10-29T14:45:03+00:00",
 "published": "2026-10-30T14:47:12+00:00",
 "updated": "2026-10-30T09:32:34.641990+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2114/",
  "https://plugins.svn.wordpress.org/simple-cloudflare-turnstile/tags/1.44.2/",
  "https://wordpress.org/plugins/simple-cloudflare-turnstile/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/simple-cloudflare-turnstile",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-30"
 }
}