# Simple CAPTCHA with Cloudflare Turnstile <= 1.44.1 - Unauthenticated CAPTCHA Bypass via Clean Login Registration Form

- **ID:** WPSEC-2026-2114
- **Plugin:** Simple CAPTCHA with Cloudflare Turnstile (`simple-cloudflare-turnstile`), https://wordpress.org/plugins/simple-cloudflare-turnstile/
- **Affected versions:** from 1.25.0 before 1.44.2
- **Fixed in:** 1.44.2 (Update to 1.44.2 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-693
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/simple-cloudflare-turnstile
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2114/

## Description

The Simple CAPTCHA with Cloudflare Turnstile plugin for WordPress is vulnerable to a CAPTCHA bypass on the Clean Login registration form in all versions up to, and including, 1.44.1. The plugin displayed a Turnstile widget on the Clean Login registration form but never verified the response on the server. Clean Login creates users directly, so the WordPress registration check never ran. On sites using the Clean Login integration, this makes it possible for unauthenticated attackers to register accounts automatically without passing the Turnstile challenge.

## References

- https://wpsec.com/vuln/WPSEC-2026-2114/
- https://plugins.svn.wordpress.org/simple-cloudflare-turnstile/tags/1.44.2/
- https://wordpress.org/plugins/simple-cloudflare-turnstile/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2114/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.