---
id: "CVE-2026-57775"
kind: "vulnerability"
aliases: ["CVE-2026-57775"]
title: "WordPress Simple Cloudflare Turnstile plugin: authentication bypass through an alternate path"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "simple-cloudflare-turnstile", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-04T08:17:17+00:00"
first_seen_at: "2026-11-04T08:26:00+00:00"
updated_at: "2026-11-04T08:26:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57775", "first_seen_at": "2026-11-04T08:26:00+00:00"}]
---

# WordPress Simple Cloudflare Turnstile plugin: authentication bypass through an alternate path

The Simple Cloudflare Turnstile WordPress plugin, by RelyWP, has an authentication bypass through an alternate path or channel, affecting versions through 1.44.1. An attacker may be able to get past the Turnstile or login check without proper authentication.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin under Plugins, or in the `simple-cloudflare-turnstile` plugin header, and see whether it is `1.44.1` or older.

## Fix

- Simple Cloudflare Turnstile: a fixed version is not stated in the sources; move to a release later than `1.44.1` once the vendor publishes one.

## Timeline

- 2026-11-04T08:26:00+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-57775

## From the sources

Authentication Bypass Using an Alternate Path or Channel vulnerability in RelyWP Simple Cloudflare Turnstile simple-cloudflare-turnstile allows Authentication Abuse.This issue affects Simple Cloudflare Turnstile: from n/a through 1.44.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_