Live › vulnerability › CVE-2026-39741
The Simple Cloudflare Turnstile WordPress plugin, through version 1.44.0, has a missing authorization check that allows access-control bypass. The sources say the flaw lets an attacker act beyond their intended permissions, but do not state exactly which actions are exposed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 13:25 UTC. All times on this page are UTC.
Sites running the Simple Cloudflare Turnstile WordPress plugin at version 1.44.0 or earlier are in scope. The sources do not say which configuration or role makes a site exposed, so unknown.
No product ranges from the sources yet.
1.44.0; the sources do not name the exact fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in RelyWP Simple Cloudflare Turnstile simple-cloudflare-turnstile allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Cloudflare Turnstile: from n/a through 1.44.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-39741")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.