WordPress Plugin Vulnerabilities

Simple Cloudflare Turnstile < 1.42.3 - Unauthenticated CAPTCHA Bypass

Description

The plugin is vulnerable to Captcha Bypass. This makes it possible for unauthenticated attackers to bypass captcha.

Affects Plugins

Plugin icon
simple-cloudflare-turnstile
Fixed in 1.42.3

References

CVE
CVE-2026-66674
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/3dcf2f22-4202-4902-9883-eb4479fe1028

Miscellaneous

Original Researcher
Ananda Dhakal
Verified
No
WPVDB ID
40d9bdcc-52dc-443b-b37a-cf2c6acaf8ab

Timeline

Publicly Published
2026-09-08 (about 1 month ago)
Added
2026-09-16 (about 1 month ago)
Last Updated
2026-09-16 (about 1 month ago)

Other

Published
Title
Published
2016-02-08
Title
WooCommerce - Store Toolkit Plugin <= 1.5.6 - Privilege Escalation
Published
2016-04-25
Title
iThemes Security <= 5.3.5 - Lack of Capability Check
Published
2015-11-11
Title
BuddyPress <= 2.3.4 - Authenticated Privilege Escalation
Published
2026-08-27
Title
Essential Addons for Elementor < 6.8.1 - Unauthenticated Captcha Bypass
Published
2017-01-11
Title
WordPress 4.7 - User Information Disclosure via REST API