CVE-2026-40799: Simple Cloudflare Turnstile Auth Bypass

CVE-2026-40799 Overview

CVE-2026-40799 is a broken authentication vulnerability affecting the Simple Cloudflare Turnstile WordPress plugin in versions up to and including 1.38.0. The plugin integrates Cloudflare Turnstile, a CAPTCHA alternative, into WordPress login and form workflows. The flaw allows unauthenticated attackers to bypass the protection the plugin is intended to enforce. The weakness is categorized under [CWE-288] (Authentication Bypass Using an Alternate Path or Channel). Patchstack assigned and published the vulnerability record, and the issue impacts integrity of authentication-related controls without affecting confidentiality or availability.

Critical Impact
Unauthenticated attackers can bypass the Turnstile CAPTCHA verification, defeating bot mitigation on protected login and submission endpoints.

Affected Products

Simple Cloudflare Turnstile WordPress plugin versions <= 1.38.0
WordPress sites using the plugin to protect login forms
WordPress sites using the plugin to protect registration, comment, or contact form submissions

Discovery Timeline

2026-06-15 - CVE-2026-40799 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-40799

Vulnerability Analysis

The vulnerability stems from broken authentication logic in the Simple Cloudflare Turnstile plugin. Turnstile is intended to validate that form submissions originate from legitimate users rather than automated clients. In affected versions, the plugin fails to properly enforce the verification path, allowing requests to reach protected endpoints without a valid Turnstile token. The defect is classified under [CWE-288], which covers authentication bypass through alternate channels.

The scope is limited to integrity impact. Attackers do not gain access to confidential data or cause denial of service through this flaw alone. Instead, they neutralize the bot-mitigation control, which raises the success rate of downstream attacks such as credential stuffing, brute-force login attempts, spam submissions, and automated account registration. The EPSS probability stands at 0.309%.

Root Cause

The root cause is improper validation of the Turnstile challenge response on the server side. The plugin trusts requests that omit or manipulate the expected verification token, providing an alternate path that bypasses the intended authentication check. Refer to the Patchstack Vulnerability Report for technical specifics.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker sends crafted HTTP requests to a WordPress endpoint protected by Simple Cloudflare Turnstile. By omitting or manipulating Turnstile-related parameters, the attacker bypasses CAPTCHA verification and submits the request as if validation had succeeded. This enables automation of login attempts and form submissions against sites that rely on the plugin for bot protection.

Detection Methods for CVE-2026-40799

Indicators of Compromise

Spikes in failed login attempts against wp-login.php on sites using Simple Cloudflare Turnstile
High-volume form submissions (registration, comments, contact) without corresponding Turnstile challenge traffic to Cloudflare
Successful POST requests to protected endpoints lacking the cf-turnstile-response parameter or containing invalid tokens

Detection Strategies

Inspect web server access logs for POST requests to protected endpoints that lack a valid Turnstile token field
Correlate WordPress authentication logs with upstream Cloudflare Turnstile verification telemetry to find mismatches
Alert on anomalous submission rates from single IPs or autonomous systems targeting login and registration endpoints

Monitoring Recommendations

Enable verbose logging for the Simple Cloudflare Turnstile plugin and centralize logs for correlation
Track plugin version inventory across WordPress sites and flag installations at <= 1.38.0
Monitor for sudden increases in account creation, password reset, or comment submission volume

How to Mitigate CVE-2026-40799

Immediate Actions Required

Update the Simple Cloudflare Turnstile plugin to a version newer than 1.38.0 as soon as the vendor publishes a fixed release
Audit WordPress sites for the affected plugin and identify forms relying on it for bot mitigation
Enforce strong password policies and rate limiting on wp-login.php and registration endpoints to reduce risk during the patch window

Patch Information

Review the Patchstack Vulnerability Report for fixed version guidance. Apply the latest plugin update through the WordPress admin dashboard or via WP-CLI. Verify the installed version is greater than 1.38.0 after update.

Workarounds

Deploy a Web Application Firewall (WAF) rule that requires a valid cf-turnstile-response parameter on protected POST requests
Enable Cloudflare Bot Fight Mode or equivalent rate limiting at the edge to reduce automated abuse
Temporarily disable the plugin and substitute an alternative CAPTCHA provider until a patched release is available

bash

# Example: WP-CLI commands to inventory and update the plugin
wp plugin list --name=simple-cloudflare-turnstile --fields=name,version,status
wp plugin update simple-cloudflare-turnstile
wp plugin get simple-cloudflare-turnstile --field=version