Simple CAPTCHA Unauthenticated Turnstile Bypass via Reusable Cache Key (CVE-2026-15239)

Vulnerability Overview Vulnerability Name: Simple CAPTCHA with Cloudflare Turnstile < 1.42.0 - Unauthenticated Turnstile Protection Bypass via Reusable Forminator Cache Key Vulnerability Description: The plugin does not bind its Turnstile validation cache to single-use challenge tokens within its Forminator integration; instead, it caches requests based on attacker-controlled, reusable values. This allows an unauthenticated attacker to solve a challenge and then replay the tokenless form submission, thereby bypassing the anti-abuse protection provided by the plugin within a short time window. CVE ID: CVE-2026-15239 Affected Scope Affected Plugin: simple-cloudflare-turnstile Fixed Version: 1.42.0 Remediation Fixed Version: Upgrade to version 1.42.0 or higher. Timeline Public Disclosure Date: 2026-08-03 Added Date: 2026-08-03 Last Updated: 2026-08-03 Additional Information Original Researcher: Meher Sudhakar Abbireddi Submitter: Meher Sudhakar Abbireddi Validation Status: Verified WPVDB ID: 28d3bda2-501c-4eeb-9184-c343367adbea Related Vulnerabilities Payment Gateway for PayPal on WooCommerce < 9.2.1 - Unauthenticated Payment Bypass via PayPal Advanced Return Handler W3 Total Cache < 0.9.5 - Weak Validation of Amazon SNS Push Messages BackWPup <= 3.4.1 - Backup File Download Multiple Themes - Privilege Escalation WP Events Manager < 2.2.5 - Unauthenticated Payment Bypass and Booking Status Update via IDOR POC Code POC Code: The PoC will be displayed on August 17, 2026, to give users the time to update.

Goal Reached Thanks to every supporter — we hit 100%!

Simple CAPTCHA Unauthenticated Turnstile Bypass via Reusable Cache Key (CVE-2026-15239)

More from this source