Simple Cloudflare Turnstile
Monthly
CAPTCHA verification bypass in the Simple Cloudflare Turnstile WordPress plugin (versions ≤ 1.42.1) allows unauthenticated network attackers to spoof successful challenge completion and circumvent bot-protection controls on any WordPress form protected by this plugin. The root cause is classified as CWE-290 (Authentication Bypass by Spoofing), meaning the plugin fails to adequately verify the integrity or authenticity of the Turnstile challenge response before granting form access. Reported by Patchstack, no active exploitation is confirmed at time of analysis.
Unauthenticated content injection in the Simple Cloudflare Turnstile WordPress plugin (versions <= 1.42.1) allows remote attackers without any credentials to inject arbitrary content into affected WordPress sites. Reported by Patchstack and classified under CWE-94 (Code Injection), the flaw exposes sites to partial confidentiality and integrity compromise (CVSS C:L/I:L) via a network-accessible attack requiring no user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis.
Broken authentication in the Simple Cloudflare Turnstile WordPress plugin (versions ≤ 1.38.0) allows unauthenticated remote attackers to bypass Cloudflare Turnstile CAPTCHA verification on any protected form without completing the bot-detection challenge. Classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel) and reported by Patchstack, the flaw enables automated or scripted form submissions that the plugin was designed to block - including login, registration, contact, and WooCommerce checkout forms. No public exploit code has been identified at time of analysis, though the network-accessible, zero-complexity nature of the bypass makes it trivially replicable by any attacker familiar with WordPress form mechanics.
CAPTCHA verification bypass in the Simple Cloudflare Turnstile WordPress plugin (versions ≤ 1.42.1) allows unauthenticated network attackers to spoof successful challenge completion and circumvent bot-protection controls on any WordPress form protected by this plugin. The root cause is classified as CWE-290 (Authentication Bypass by Spoofing), meaning the plugin fails to adequately verify the integrity or authenticity of the Turnstile challenge response before granting form access. Reported by Patchstack, no active exploitation is confirmed at time of analysis.
Unauthenticated content injection in the Simple Cloudflare Turnstile WordPress plugin (versions <= 1.42.1) allows remote attackers without any credentials to inject arbitrary content into affected WordPress sites. Reported by Patchstack and classified under CWE-94 (Code Injection), the flaw exposes sites to partial confidentiality and integrity compromise (CVSS C:L/I:L) via a network-accessible attack requiring no user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis.
Broken authentication in the Simple Cloudflare Turnstile WordPress plugin (versions ≤ 1.38.0) allows unauthenticated remote attackers to bypass Cloudflare Turnstile CAPTCHA verification on any protected form without completing the bot-detection challenge. Classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel) and reported by Patchstack, the flaw enables automated or scripted form submissions that the plugin was designed to block - including login, registration, contact, and WooCommerce checkout forms. No public exploit code has been identified at time of analysis, though the network-accessible, zero-complexity nature of the bypass makes it trivially replicable by any attacker familiar with WordPress form mechanics.