EUVD-2026-54401
GHSA-w6f5-3mw7-jjxq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-reachable with no auth or user interaction; impact is limited to integrity (CAPTCHA bypass enabling form abuse) with no confidentiality or availability effect.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin before 1.42.0 does not bind its Turnstile validation cache to the single-use challenge token in its Forminator integration, instead keying it to an attacker-controlled, reusable request value, allowing unauthenticated attackers to solve one challenge and then replay token-less form submissions for a short window, defeating the anti-abuse protection the plugin provides.
AnalysisAI
CAPTCHA bypass in the Simple CAPTCHA with Cloudflare Turnstile WordPress plugin before 1.42.0 allows unauthenticated network attackers to defeat anti-abuse protections on Forminator-integrated forms by exploiting a flawed validation cache keying mechanism. After solving a single legitimate Turnstile challenge, an attacker can replay token-less form submissions during the validation cache window because the cache is bound to an attacker-controlled, reusable request value rather than the one-time challenge token. A publicly available proof-of-concept exists (WPScan); this vulnerability is not currently listed in CISA KEV, and no EPSS score was provided in source data.
Technical ContextAI
Cloudflare Turnstile is a CAPTCHA-alternative service that issues single-use challenge tokens to verify human interaction. The affected plugin (CPE: cpe:2.3:a:unknown:simple_captcha_with_cloudflare_turnstile:*:*:*:*:*:*:*:*) provides integration between Turnstile and Forminator, a popular WordPress form-building plugin. The core flaw is a cache design error: when the plugin validates a Turnstile token server-side, it caches the positive validation result keyed to a value supplied by the attacker in the request rather than to the immutable, single-use Turnstile token. This breaks the cryptographic guarantee Turnstile is designed to provide - each token should be consumed exactly once - and transforms the CAPTCHA from a per-submission gate into a per-session bypass. No CWE was assigned by NVD, but the root cause class aligns with CWE-290 (Authentication Bypass by Spoofing) or CWE-345 (Insufficient Verification of Data Authenticity), specifically the failure to bind the integrity check to the correct, non-replayable identifier.
RemediationAI
The primary remediation is to upgrade the Simple CAPTCHA with Cloudflare Turnstile plugin to version 1.42.0 or later, which corrects the cache keying logic to bind validation to the single-use Turnstile token. The fix is vendor-confirmed and the upgrade path is straightforward via the WordPress admin dashboard or WP-CLI. If immediate upgrade is not possible, a compensating control is to disable the plugin's Forminator integration temporarily and use an alternative CAPTCHA or manual review workflow for public-facing forms, accepting the trade-off of either reduced form accessibility or increased manual workload. Blocking or rate-limiting form submission endpoints at the WAF or web server level by IP or user-agent can reduce the practical impact of replay abuse but will not eliminate it against distributed sources. After upgrading, administrators should review form submission logs for anomalous bursts during the pre-patch exposure window. The WPScan advisory at https://wpscan.com/vulnerability/28d3bda2-501c-4eeb-9184-c343367adbea/ should be reviewed for any additional vendor guidance.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today