EUVD-2026-36808
GHSA-x75m-vg6j-vq53
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-accessible unauthenticated form bypass with no user interaction; integrity-only impact since bypass enables unauthorized form submissions but confers no data read or availability disruption.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Broken Authentication in Simple Cloudflare Turnstile <= 1.38.0 versions.
AnalysisAI
Broken authentication in the Simple Cloudflare Turnstile WordPress plugin (versions ≤ 1.38.0) allows unauthenticated remote attackers to bypass Cloudflare Turnstile CAPTCHA verification on any protected form without completing the bot-detection challenge. Classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel) and reported by Patchstack, the flaw enables automated or scripted form submissions that the plugin was designed to block - including login, registration, contact, and WooCommerce checkout forms. No public exploit code has been identified at time of analysis, though the network-accessible, zero-complexity nature of the bypass makes it trivially replicable by any attacker familiar with WordPress form mechanics.
Technical ContextAI
The Simple Cloudflare Turnstile plugin by RelyWP (CPE: cpe:2.3:a:relywp:simple_cloudflare_turnstile) integrates Cloudflare's Turnstile CAPTCHA service into WordPress form workflows, replacing or supplementing reCAPTCHA with a privacy-preserving bot-detection challenge. CWE-288 (Authentication Bypass Using an Alternate Path or Channel) indicates the server-side verification of the Turnstile challenge response token is flawed - the plugin either fails to call the Cloudflare Siteverify API endpoint under certain conditions, accepts an absent or malformed token, or exposes an alternate submission path that skips the validation routine entirely. This is a server-side logic defect, not a cryptographic weakness: Cloudflare's own Turnstile service is not compromised; rather, the plugin's integration layer fails to enforce successful challenge completion before accepting form input.
RemediationAI
Update the Simple Cloudflare Turnstile plugin to a version above 1.38.0 as soon as a patched release is published by RelyWP - the Patchstack advisory page should be monitored for the confirmed fix version, as no patched version number is independently confirmed from the available data. In the interim, administrators who cannot immediately update should consider temporarily disabling Turnstile protection on the most abuse-sensitive forms and replacing it with an alternative CAPTCHA or anti-spam mechanism; note that disabling forms will impact legitimate user flows and should be weighed against abuse risk. As a more targeted compensating control, a custom server-side middleware or mu-plugin can independently call the Cloudflare Turnstile Siteverify API (https://challenges.cloudflare.com/turnstile/v0/siteverify) on every form submission, bypassing the vulnerable plugin validation logic entirely - this mitigates the bypass without disabling forms but requires development effort. WAF rate-limiting rules (e.g., via Cloudflare WAF or a WordPress security plugin) on form submission endpoints can reduce automated abuse volume but do not remediate the underlying authentication bypass.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today