# Simple CAPTCHA with Cloudflare Turnstile <= 1.44.4 - Unauthenticated CAPTCHA Bypass via Ultimate Member Login Token Reuse

- **ID:** WPSEC-2026-2315
- **Plugin:** Simple CAPTCHA with Cloudflare Turnstile (`simple-cloudflare-turnstile`), https://wordpress.org/plugins/simple-cloudflare-turnstile/
- **Affected versions:** from 1.41.1 before 1.44.5
- **Fixed in:** 1.44.5 (Update to 1.44.5 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-307
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/simple-cloudflare-turnstile
- **Fix released:** 2026-10-31
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2315/

## Description

The Simple CAPTCHA with Cloudflare Turnstile plugin for WordPress is vulnerable to CAPTCHA Bypass via the Ultimate Member login form integration in all versions up to, and including, 1.44.4, due to the plugin storing a verification flag tied to the submitted Turnstile token (for the form, and for the targeted user ID for 300 seconds) before Ultimate Member checks the password, and then accepting that flag instead of verifying the token again. This makes it possible for unauthenticated attackers to solve a single Turnstile challenge and resubmit the same token with any number of password guesses during that window, defeating the brute-force protection. Exploitation requires the plugin's Ultimate Member login protection to be enabled.

## References

- https://wpsec.com/vuln/WPSEC-2026-2315/
- https://plugins.svn.wordpress.org/simple-cloudflare-turnstile/tags/1.44.5/
- https://wordpress.org/plugins/simple-cloudflare-turnstile/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2315/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.