CVE-2026-66632
MediumCVSS 6.5Summary
The Simple Cloudflare Turnstile plugin in versions up to and including 1.42.1 is vulnerable to Content Injection that can be performed by an unauthenticated attacker. This allows unwanted content to be placed in the site's context.
Risk Assessment
An unauthenticated attacker can inject arbitrary content, which may be used for phishing, disinformation, or manipulation of how the site is perceived. This may harm reputation and user security.
Recommendation
Update the Simple Cloudflare Turnstile plugin to a version newer than 1.42.1 containing the fix. Check site content for unauthorized modifications.
Other vulnerabilities in Simple Cloudflare Turnstile
See all- CVE-2026-66674Medium
The Simple Cloudflare Turnstile plugin in versions up to and including 1.42.1 contains a Bypass vulnerability exploitable by an unauthenticated attacker. This allows circumvention of the protection mechanism provided by the plugin.
- CVE-2026-40799Medium
Versions of Simple Cloudflare Turnstile up to 1.38.0 have a vulnerability in authentication that allows unauthorized access.
Original NVD description (English source)
Unauthenticated Content Injection in Simple Cloudflare Turnstile <= 1.42.1 versions.