CVE-2026-15239

Deferred Deferred - Pending Action

Simple CAPTCHA with Cloudflare Turnstile WordPress plugin authentication bypass

Publication date: 2026-08-07

Last updated on: 2026-08-26

Assigner: WPScan

Description

The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin before 1.42.0 does not bind its Turnstile validation cache to the single-use challenge token in its Forminator integration, instead keying it to an attacker-controlled, reusable request value, allowing unauthenticated attackers to solve one challenge and then replay token-less form submissions for a short window, defeating the anti-abuse protection the plugin provides.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-07

Last Modified

2026-08-26

Generated

2026-08-27

AI Q&A

2026-08-07

EPSS Evaluated

2026-08-26

NVD

CVE-2026-15239

EUVD

EUVD-2026-54401

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-345	The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Simple CAPTCHA with Cloudflare Turnstile WordPress plugin before version 1.42.0. It allows unauthenticated attackers to bypass Turnstile protection by solving one challenge and then replaying token-less form submissions for a short window due to improper caching of validation tokens.

Detection Guidance

To detect this vulnerability, check if your WordPress site uses the Simple CAPTCHA with Cloudflare Turnstile plugin version below 1.42.0. Inspect plugin files for improper Turnstile token validation caching in Forminator integration. No direct commands are provided in the context.

Impact Analysis

Attackers could exploit this to submit forms without solving CAPTCHAs, potentially enabling spam, brute force attacks, or unauthorized actions on forms protected by the plugin. This undermines the intended anti-abuse protection.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized form submissions, which may lead to data processing without proper consent or exposure of sensitive information. The bypass of anti-abuse protection could result in unauthorized data collection or processing activities.

Mitigation Strategies

Update the Simple CAPTCHA with Cloudflare Turnstile WordPress plugin to version 1.42.0 or later to patch the vulnerability.

Hi! I’m here to help you understand CVE-2026-15239. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70