CVE-2026-66674
MediumCVSS 5.6Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The Simple Cloudflare Turnstile plugin in versions up to and including 1.42.1 contains a Bypass vulnerability exploitable by an unauthenticated attacker. This allows circumvention of the protection mechanism provided by the plugin.
Risk Assessment
An unauthenticated attacker can bypass the Turnstile protection, potentially enabling automated attacks, spam, or other abuse of protected forms. This undermines the effectiveness of bot protection.
Recommendation
Update the Simple Cloudflare Turnstile plugin to a version newer than 1.42.1 containing the fix. Monitor forms for unusual traffic.
Other vulnerabilities in Simple Cloudflare Turnstile
See all- CVE-2026-39741Medium
The Simple Cloudflare Turnstile plugin for WordPress (up to version 1.44.0) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
- CVE-2026-66632Medium
The Simple Cloudflare Turnstile plugin in versions up to and including 1.42.1 is vulnerable to Content Injection that can be performed by an unauthenticated attacker. This allows unwanted content to be placed in the site's context.
- CVE-2026-40799Medium
Versions of Simple Cloudflare Turnstile up to 1.38.0 have a vulnerability in authentication that allows unauthorized access.
Original NVD description (English source)
Unauthenticated Bypass Vulnerability in Simple Cloudflare Turnstile <= 1.42.1 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS