Simple CAPTCHA with Cloudflare Turnstile <= 1.44.4 - Unauthenticated CAPTCHA Bypass via Ultimate Member Login Token Reuse
- ID
- WPSEC-2026-2315
- Plugin
- Simple CAPTCHA with Cloudflare Turnstile (simple-cloudflare-turnstile)
- Affected
- from 1.41.1 before 1.44.5
- Remediation
- Update to 1.44.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-307
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-03
- Attack surface
- Simple CAPTCHA with Cloudflare Turnstile on WPSec AttackSurface
- Fix released
- Published
Description
The Simple CAPTCHA with Cloudflare Turnstile plugin for WordPress is vulnerable to CAPTCHA Bypass via the Ultimate Member login form integration in all versions up to, and including, 1.44.4, due to the plugin storing a verification flag tied to the submitted Turnstile token (for the form, and for the targeted user ID for 300 seconds) before Ultimate Member checks the password, and then accepting that flag instead of verifying the token again. This makes it possible for unauthenticated attackers to solve a single Turnstile challenge and resubmit the same token with any number of password guesses during that window, defeating the brute-force protection. Exploitation requires the plugin's Ultimate Member login protection to be enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-2315/
- https://plugins.svn.wordpress.org/simple-cloudflare-turnstile/tags/1.44.5/
- https://wordpress.org/plugins/simple-cloudflare-turnstile/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS