CVE-2026-15239

MediumCVSS 5.3

Published: 07/08/2026(UTC)Updated: 26/08/2026(UTC)Translated: 07/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.11%

1th percentile - higher than 1% of all known CVEs

Summary

The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin before version 1.42.0 does not bind its Turnstile validation cache to the single-use challenge token in its Forminator integration, instead keying it to an attacker-controlled, reusable request value. This allows unauthenticated attackers to solve one challenge and then replay token-less form submissions for a short window, defeating the anti-abuse protection.

Risk Assessment

An attacker can bypass the CAPTCHA mechanism, enabling form submission automation, spam, or brute-force attacks. This may lead to server overload or data integrity issues.

Recommendation

Update the Simple CAPTCHA with Cloudflare Turnstile plugin to version 1.42.0 or later. Verify that the Forminator integration is correctly configured.

Other vulnerabilities in Simple CAPTCHA with Cloudflare Turnstile

CVE-2026-93900Medium
The Simple CAPTCHA with Cloudflare Turnstile plugin for WordPress (versions up to and including 1.44.3) is vulnerable to stored cross-site scripting via the 'id' attribute of the [gravity-simple-turnstile] shortcode. This is due to insufficient input sanitization and output escaping in the cfturnstile_gravity_shortcode() function: the value is filtered only by esc_html() and sanitize_text_field() (neither of which removes parentheses or dots) and then emitted via esc_js() in a raw JavaScript expression context outside any string literal. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages that execute whenever a user visits the injected page.

Original NVD description (English source)

The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin before 1.42.0 does not bind its Turnstile validation cache to the single-use challenge token in its Forminator integration, instead keying it to an attacker-controlled, reusable request value, allowing unauthenticated attackers to solve one challenge and then replay token-less form submissions for a short window, defeating the anti-abuse protection the plugin provides.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS