# Simple CAPTCHA with Cloudflare Turnstile <= 1.44.4 - Unauthenticated CAPTCHA Bypass via Sunshine Photo Cart Nonces on WordPress Login and Registration Forms

- **ID:** WPSEC-2026-2316
- **Plugin:** Simple CAPTCHA with Cloudflare Turnstile (`simple-cloudflare-turnstile`), https://wordpress.org/plugins/simple-cloudflare-turnstile/
- **Affected versions:** from 1.39.0 before 1.44.5
- **Fixed in:** 1.44.5 (Update to 1.44.5 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-287
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/simple-cloudflare-turnstile
- **Fix released:** 2026-10-31
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2316/

## Description

The Simple CAPTCHA with Cloudflare Turnstile plugin for WordPress is vulnerable to CAPTCHA Bypass via the Sunshine Photo Cart integration in versions 1.39.0 up to, and including, 1.44.4, due to the integration skipping the WordPress login and registration Turnstile checks whenever a valid Sunshine login, signup or checkout nonce is posted, even though these nonces are printed on public pages for logged-out visitors. This makes it possible for unauthenticated attackers to add such a nonce to a wp-login.php login or registration request and skip the Turnstile challenge, allowing automated password guessing and automated account registration. Exploitation requires Sunshine Photo Cart to be active and the plugin's WordPress login or registration protection to be enabled.

## References

- https://wpsec.com/vuln/WPSEC-2026-2316/
- https://plugins.svn.wordpress.org/simple-cloudflare-turnstile/tags/1.44.5/
- https://wordpress.org/plugins/simple-cloudflare-turnstile/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2316/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.