CVE-2026-15239
Received Received - Intake

Simple CAPTCHA with Cloudflare Turnstile WordPress plugin authentication bypass

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: WPScan

Description
The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin before 1.42.0 does not bind its Turnstile validation cache to the single-use challenge token in its Forminator integration, instead keying it to an attacker-controlled, reusable request value, allowing unauthenticated attackers to solve one challenge and then replay token-less form submissions for a short window, defeating the anti-abuse protection the plugin provides.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-07
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-15239
EUVD
EUVD-2026-54401

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Simple CAPTCHA with Cloudflare Turnstile WordPress plugin before version 1.42.0. It allows unauthenticated attackers to bypass Turnstile protection by solving one challenge and then replaying token-less form submissions for a short window due to improper caching of validation tokens.

Impact Analysis

Attackers could exploit this to submit forms without solving CAPTCHAs, potentially enabling spam, brute force attacks, or unauthorized actions on forms protected by the plugin. This undermines the intended anti-abuse protection.

Mitigation Strategies

Update the Simple CAPTCHA with Cloudflare Turnstile WordPress plugin to version 1.42.0 or later to patch the vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15239. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart