CVE-2026-66632— WordPress Simple Cloudflare Turnstile plugin <= 1.42.1 - Content Injection vulnerability
Quick assessment
Affected
Elliot Sowers/ RelyWP Simple Cloudflare Turnstile
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Simple Cloudflare Turnstile 插件（版本 ≤ 1.42.1）存在未经身份验证的内容注入漏洞。
Possible ATT&CK Techniques 3 AI
T1190 · Exploit Public-Facing Application T1190.001 T1210 · Exploitation of Remote Services
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-66632
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WordPress Simple Cloudflare Turnstile plugin <= 1.42.1 - Content Injection vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Unauthenticated Content Injection in Simple Cloudflare Turnstile <= 1.42.1 versions.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Elliot Sowers/ RelyWP | Simple Cloudflare Turnstile | n/a ~ 1.42.1 | - |
|
II. Public POCs for CVE-2026-66632
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-66632
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-66632 (1)
IV. Related Vulnerabilities
Same weakness: CWE-94
-
CVE-2026-81803
WordPress RepairBuddy plugin <= 4.1224 - Remote Code Executi -
CVE-2026-80352
Apache Camel K: Camel K Master trait serviceAccountName YAML -
CVE-2026-87817
GitPython before 3.1.60 Remote Code Execution via Git Direct -
CVE-2026-85978
Unauthenticated Remote Code Execution in Akana API Platform -
CVE-2026-86076
n8n: Expression Sandbox Escape in Editor-UI Enables Stored C
V. Comments for CVE-2026-66632
No comments yet