CVE-2026-39741
MediumCVSS 5.3Summary
The Simple Cloudflare Turnstile plugin for WordPress (up to version 1.44.0) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
Risk Assessment
An attacker could perform actions they are not authorized to do, potentially leading to unauthorized changes in site configuration or data.
Recommendation
Update the Simple Cloudflare Turnstile plugin to the latest version and review user permissions and roles in WordPress.
Other vulnerabilities in Simple Cloudflare Turnstile
See all- CVE-2026-66632Medium
The Simple Cloudflare Turnstile plugin in versions up to and including 1.42.1 is vulnerable to Content Injection that can be performed by an unauthenticated attacker. This allows unwanted content to be placed in the site's context.
- CVE-2026-66674Medium
The Simple Cloudflare Turnstile plugin in versions up to and including 1.42.1 contains a Bypass vulnerability exploitable by an unauthenticated attacker. This allows circumvention of the protection mechanism provided by the plugin.
- CVE-2026-40799Medium
Versions of Simple Cloudflare Turnstile up to 1.38.0 have a vulnerability in authentication that allows unauthorized access.
Original NVD description (English source)
Missing Authorization vulnerability in RelyWP Simple Cloudflare Turnstile simple-cloudflare-turnstile allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Cloudflare Turnstile: from n/a through 1.44.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS