CVE-2026-40799
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Versions of Simple Cloudflare Turnstile up to 1.38.0 have a vulnerability in authentication that allows unauthorized access.
Risk Assessment
Organizations may be exposed to attacks that exploit this vulnerability to hijack user sessions or gain access to protected resources.
Recommendation
It is recommended to upgrade to the latest version of Simple Cloudflare Turnstile to mitigate this vulnerability.
Other vulnerabilities in Simple Cloudflare Turnstile
See all- CVE-2026-39741Medium
The Simple Cloudflare Turnstile plugin for WordPress (up to version 1.44.0) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
- CVE-2026-66632Medium
The Simple Cloudflare Turnstile plugin in versions up to and including 1.42.1 is vulnerable to Content Injection that can be performed by an unauthenticated attacker. This allows unwanted content to be placed in the site's context.
- CVE-2026-66674Medium
The Simple Cloudflare Turnstile plugin in versions up to and including 1.42.1 contains a Bypass vulnerability exploitable by an unauthenticated attacker. This allows circumvention of the protection mechanism provided by the plugin.
Original NVD description (English source)
Unauthenticated Broken Authentication in Simple Cloudflare Turnstile <= 1.38.0 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS