CVE-2026-57775 · Package
NO FIX YET · SEE WHAT TO DO
The Simple Cloudflare Turnstile WordPress plugin, by RelyWP, has an authentication bypass through an alternate path or channel, affecting versions through 1.44.1. An attacker may be able to get past the Turnstile or login check without proper authentication.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Sites running the Simple Cloudflare Turnstile WordPress plugin at version 1.44.1 or older are in scope. The sources do not say which configurations expose the bypass, so the exact conditions are unknown.
Not affected if plugin-not-installed
Who cares simple-cloudflare-turnstile, wordpress
simple-cloudflare-turnstile plugin header, and see whether it is 1.44.1 or older.1.44.1 once the vendor publishes one.Authentication Bypass Using an Alternate Path or Channel vulnerability in RelyWP Simple Cloudflare Turnstile simple-cloudflare-turnstile allows Authentication Abuse.This issue affects Simple Cloudflare Turnstile: from n/a through 1.44.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-57775") · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.