---
id: "CVE-2026-119498"
page: "https://infrastack.ai/live/CVE-2026-119498"
kind: "vulnerability"
aliases: ["CVE-2026-119498"]
title: "WordPress Simple Cloudflare Turnstile plugin: authentication bypass through alternate path"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "simple-cloudflare-turnstile", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-07T12:17:44+00:00"
first_seen_at: "2026-11-07T12:47:08+00:00"
updated_at: "2026-11-07T12:49:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119498", "first_seen_at": "2026-11-07T12:47:08+00:00"}]
exploit_sources: []
---

# WordPress Simple Cloudflare Turnstile plugin: authentication bypass through alternate path

Link for people: https://infrastack.ai/live/CVE-2026-119498 (this .md is for agents)

The Simple Cloudflare Turnstile WordPress plugin, by RelyWP, has an authentication bypass flaw in versions through 1.44.4. The sources describe it as allowing authentication abuse, without detail on the exact path.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Simple Cloudflare Turnstile plugin (`simple-cloudflare-turnstile`) in the WordPress admin under Plugins.

## Fix

- Simple Cloudflare Turnstile: a fixed version is not stated in the sources; the affected range runs through `1.44.4`.

## Timeline

- 2026-11-07T12:47:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119498

## From the sources

Authentication Bypass Using an Alternate Path or Channel vulnerability in RelyWP Simple Cloudflare Turnstile simple-cloudflare-turnstile allows Authentication Abuse.This issue affects Simple Cloudflare Turnstile: from n/a through 1.44.4.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_