Description

The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin before 1.42.0 does not bind its Turnstile validation cache to the single-use challenge token in its Forminator integration, instead keying it to an attacker-controlled, reusable request value, allowing unauthenticated attackers to solve one challenge and then replay token-less form submissions for a short window, defeating the anti-abuse protection the plugin provides.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-07T08:16:45.897Z",
  "pubdate": "2026-08-07T08:16:45.897Z",
  "executiveSummary": "The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin before version 1.42.0 suffers from an improper validation cache implementation within its Forminator integration. This flaw allows unauthenticated remote attackers to bypass anti-abuse protections and submit forms without valid validation tokens. The root cause stems from the validation cache being keyed to an attacker-controlled, reusable request value rather than binding cryptographically to the single-use challenge token issued by Cloudflare Turnstile. Consequently, an attacker who solves a single legitimate CAPTCHA challenge can capture the resultant state and replay arbitrary token-less form submissions within a short temporal window. The risk implication is significant as it undermines the primary security objective of the CAPTCHA mechanism, enabling automated abuse, spam generation, and potential brute-force or injection attacks against Forminator endpoints without requiring further interactive human intervention. Exploitation requires no prior authentication or elevated privileges, relying solely on network exposure to the vulnerable WordPress installation and the ability to intercept and replay HTTP POST requests containing the flawed request parameter mapping.",
  "technicalDetails": "The vulnerability resides in the validation logic handling the Cloudflare Turnstile integration within the Forminator form plugin context. During the verification process, the Simple CAPTCHA with Cloudflare Turnstile plugin validates the cryptographic challenge response provided by the user. However, instead of strictly binding the resulting validation success status to the unique, single-use challenge token issued by the Turnstile API for that specific interaction, the plugin incorrectly maps the validation cache state to an arbitrary request value supplied by the client.\nBecause the key used in the validation cache lookup is controlled by the attacker and is inherently reusable across multiple requests within a brief timeframe, the security controls fail. The step-by-step attack flow initiates when an unauthenticated attacker requests a form page and solves the Cloudflare Turnstile challenge once, generating a valid verification state. Instead of consuming the token in a strict one-to-one validation cycle, the plugin caches the success status against the controllable request parameter.\nThe attacker then captures the HTTP request structure and proceeds to dispatch multiple subsequent form submissions within the caching window. These subsequent requests omit the valid Turnstile token entirely or supply stale tokens, yet the backend validation routine queries its internal cache using the attacker-controlled parameter, retrieves a positive validation match, and successfully processes the form payload. This completely circumvents the anti-abuse constraints enforced by the plugin. The affected component is the integration module handling Forminator submissions in versions prior to 1.42.0. The attack requires network access to the target WordPress site, operates entirely without authentication or privileges, and allows unauthorized automated request processing during the cache validity window."
}