WordPress Simple Cloudflare Turnstile plugin <= 1.44.0 - Broken Access Control vulnerability

simple-cloudflare-turnstile · Missing authorization · CWE-862

Affectedsimple-cloudflare-turnstile

FixUpdate to 1.44.1 or newer

PublishedOct 29, 13:06 · Patchstack

ScoredOct 29 · 5.3 · Patchstack

Exploit code publicNone known · checked 21:18 UTC

ExploitedNone known · CISA KEV checked 22:06 UTC

What we know

No known exploitation. CISA KEV, checked 22:06 UTC.

No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.

An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.

Description

Missing Authorization vulnerability in RelyWP Simple Cloudflare Turnstile simple-cloudflare-turnstile allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Cloudflare Turnstile: from n/a through 1.44.0.

From Patchstack

Affected and fixed versions

ProductAffectedFixed insimple-cloudflare-turnstileearlier versions1.44.1

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

patchstack.com/database/wordpress/plugin/simple-cloudflare-turnstile/vulnerability/wordpress-simple-cloudflare-turnstile-plugin-1-44-0-broken-access-control-vulnerability?_s_id=cve · patchstack.comvdb entry

Other CVEs in simple-cloudflare-turnstile

All 1 →

5.8WordPress Simple Cloudflare Turnstile plugin <= 1.38.0 - Broken Authentication vulnerability · CVE-2026-40799Jun 15