Simple CAPTCHA with Cloudflare Turnstile <= 1.44.4 - Unauthenticated CAPTCHA Bypass via Sunshine Photo Cart Nonces on WordPress Login and Registration Forms
- ID
- WPSEC-2026-2316
- Plugin
- Simple CAPTCHA with Cloudflare Turnstile (simple-cloudflare-turnstile)
- Affected
- from 1.39.0 before 1.44.5
- Remediation
- Update to 1.44.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-287
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-03
- Attack surface
- Simple CAPTCHA with Cloudflare Turnstile on WPSec AttackSurface
- Fix released
- Published
Description
The Simple CAPTCHA with Cloudflare Turnstile plugin for WordPress is vulnerable to CAPTCHA Bypass via the Sunshine Photo Cart integration in versions 1.39.0 up to, and including, 1.44.4, due to the integration skipping the WordPress login and registration Turnstile checks whenever a valid Sunshine login, signup or checkout nonce is posted, even though these nonces are printed on public pages for logged-out visitors. This makes it possible for unauthenticated attackers to add such a nonce to a wp-login.php login or registration request and skip the Turnstile challenge, allowing automated password guessing and automated account registration. Exploitation requires Sunshine Photo Cart to be active and the plugin's WordPress login or registration protection to be enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-2316/
- https://plugins.svn.wordpress.org/simple-cloudflare-turnstile/tags/1.44.5/
- https://wordpress.org/plugins/simple-cloudflare-turnstile/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS