{
 "id": "WPSEC-2026-2115",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2115/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2115/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2115/index.md",
 "title": "Simple CAPTCHA with Cloudflare Turnstile <= 1.44.1 - Unauthenticated CAPTCHA Bypass via Easy Digital Downloads Integration on WordPress Login Form",
 "description": "The Simple CAPTCHA with Cloudflare Turnstile plugin for WordPress is vulnerable to a CAPTCHA bypass on the WordPress login form in all versions up to, and including, 1.44.1. The Turnstile login check was skipped whenever a request carried a valid Easy Digital Downloads login nonce, which EDD prints on its public login forms. It was also skipped whenever an EDD purchase action had already run during the request, and such actions can be triggered on wp-login.php through the edd_action parameter. On sites running Easy Digital Downloads, this makes it possible for unauthenticated attackers to skip the Turnstile verification on wp-login.php and run automated login and brute-force attempts the site owner intended to block.",
 "plugin": {
  "slug": "simple-cloudflare-turnstile",
  "name": "Simple CAPTCHA with Cloudflare Turnstile",
  "full_name": "Simple CAPTCHA with Cloudflare Turnstile",
  "wordpress_org": "https://wordpress.org/plugins/simple-cloudflare-turnstile/",
  "advisories_url": "https://wpsec.com/vuln/plugin/simple-cloudflare-turnstile/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/simple-cloudflare-turnstile"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-693"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.44.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.44.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.44.2",
 "remediation": "Update to 1.44.2 or later.",
 "fix_released": "2026-10-29T14:45:03+00:00",
 "published": "2026-10-30T14:47:12+00:00",
 "updated": "2026-10-30T09:32:34.641990+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2115/",
  "https://plugins.svn.wordpress.org/simple-cloudflare-turnstile/tags/1.44.2/",
  "https://wordpress.org/plugins/simple-cloudflare-turnstile/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/simple-cloudflare-turnstile",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-30"
 }
}