Simple CAPTCHA with Cloudflare Turnstile <= 1.44.1 - Unauthenticated CAPTCHA Bypass via Easy Digital Downloads Integration on WordPress Login Form
- ID
- WPSEC-2026-2115
- Plugin
- Simple CAPTCHA with Cloudflare Turnstile (simple-cloudflare-turnstile)
- Affected
- all versions before 1.44.2
- Remediation
- Update to 1.44.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-693
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-30
- Attack surface
- Simple CAPTCHA with Cloudflare Turnstile on WPSec AttackSurface
- Fix released
- Published
Description
The Simple CAPTCHA with Cloudflare Turnstile plugin for WordPress is vulnerable to a CAPTCHA bypass on the WordPress login form in all versions up to, and including, 1.44.1. The Turnstile login check was skipped whenever a request carried a valid Easy Digital Downloads login nonce, which EDD prints on its public login forms. It was also skipped whenever an EDD purchase action had already run during the request, and such actions can be triggered on wp-login.php through the edd_action parameter. On sites running Easy Digital Downloads, this makes it possible for unauthenticated attackers to skip the Turnstile verification on wp-login.php and run automated login and brute-force attempts the site owner intended to block.
References
- https://wpsec.com/vuln/WPSEC-2026-2115/
- https://plugins.svn.wordpress.org/simple-cloudflare-turnstile/tags/1.44.2/
- https://wordpress.org/plugins/simple-cloudflare-turnstile/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS