{"id":"CVE-2026-119498","kind":"vulnerability","aliases":["CVE-2026-119498"],"related":[],"title":"WordPress Simple Cloudflare Turnstile plugin: authentication bypass through alternate path","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in RelyWP Simple Cloudflare Turnstile simple-cloudflare-turnstile allows Authentication Abuse.This issue affects Simple Cloudflare Turnstile: from n/a through 1.44.4.","summary":"The Simple Cloudflare Turnstile WordPress plugin, by RelyWP, has an authentication bypass flaw in versions through 1.44.4. The sources describe it as allowing authentication abuse, without detail on the exact path.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","simple-cloudflare-turnstile","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the Simple Cloudflare Turnstile plugin (`simple-cloudflare-turnstile`) in the WordPress admin under Plugins.","fix":"- Simple Cloudflare Turnstile: a fixed version is not stated in the sources; the affected range runs through `1.44.4`.","status":"open","published_at":"2026-11-07T12:17:44+00:00","first_seen_at":"2026-11-07T12:47:08+00:00","triaged_at":"2026-11-07T12:49:10+00:00","updated_at":"2026-11-07T12:49:10+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-07T12:49:10Z","model":"claude-haiku-5-5","output":{"fix":"- Simple Cloudflare Turnstile: a fixed version is not stated in the sources; the affected range runs through `1.44.4`.","reach":"internet","title":"WordPress Simple Cloudflare Turnstile plugin: authentication bypass through alternate path","impact":"high","summary":"The Simple Cloudflare Turnstile WordPress plugin, by RelyWP, has an authentication bypass flaw in versions through 1.44.4. The sources describe it as allowing authentication abuse, without detail on the exact path.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","simple-cloudflare-turnstile"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown; sources only say authentication abuse is possible","analyst_note":"Find the fixed version and the exact bypass path from the NVD entry or the vendor advisory.","how_to_check":"- Check the installed version of the Simple Cloudflare Turnstile plugin (`simple-cloudflare-turnstile`) in the WordPress admin under Plugins.\n- unknown whether any other check is needed, as the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Simple Cloudflare Turnstile WordPress plugin at version 1.44.4 or earlier are in the affected range. The sources do not describe the exact login or configuration conditions, so the exposure of any given site is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000713,"input_tokens":4237,"output_tokens":578,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119498':13A,16A '-2026':12A,15A '1.44.4':39B,83C 'abus':47B 'abuse.this':74C 'affect':76C 'allow':45B,72C 'altern':9A,58C 'authent':6A,33B,46B,54C,73C 'bypass':7A,34B,55C 'channel':61C 'cloudflar':3A,20B,25B,66C,70C,78C 'cve':11A,14A 'describ':42B 'detail':49B 'exact':52B 'flaw':35B 'issu':75C 'n/a':81C 'packag':17B 'path':10A,53B,59C 'plugin':5A,28B 'relywp':30B,64C 'simpl':2A,19B,24B,65C,69C,77C 'simple-cloudflare-turnstil':18B,68C 'sourc':41B 'turnstil':4A,21B,26B,67C,71C,79C 'use':56C 'version':37B 'vulner':62C 'without':48B 'wordpress':1A,22B,27B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Simple Cloudflare Turnstile WordPress plugin at version 1.44.4 or earlier are in the affected range. The sources do not describe the exact login or configuration conditions, so the exposure of any given site is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","simplecloudflareturnstile","wordpress"],"campaign_type":null,"search_a":"'-119498':13A,16A '-2026':12A,15A 'altern':9A 'authent':6A 'bypass':7A 'cloudflar':3A 'cve':11A,14A 'path':10A 'plugin':5A 'simpl':2A 'turnstil':4A 'wordpress':1A","search_b":"'1.44.4':39B 'abus':47B 'allow':45B 'authent':33B,46B 'bypass':34B 'cloudflar':20B,25B 'describ':42B 'detail':49B 'exact':52B 'flaw':35B 'packag':17B 'path':53B 'plugin':28B 'relywp':30B 'simpl':19B,24B 'simple-cloudflare-turnstil':18B 'sourc':41B 'turnstil':21B,26B 'version':37B 'without':48B 'wordpress':22B,27B","search_c":"'1.44.4':83C 'abuse.this':74C 'affect':76C 'allow':72C 'altern':58C 'authent':54C,73C 'bypass':55C 'channel':61C 'cloudflar':66C,70C,78C 'issu':75C 'n/a':81C 'path':59C 'relywp':64C 'simpl':65C,69C,77C 'simple-cloudflare-turnstil':68C 'turnstil':67C,71C,79C 'use':56C 'vulner':62C","first_public_at":"2026-11-07T12:17:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119498","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119498","severity":null,"published_at":"2026-11-07T12:17:44+00:00","modified_at":"2026-11-07T12:17:44+00:00","first_seen_at":"2026-11-07T12:47:08+00:00","fetched_at":"2026-11-07T12:47:08+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}