CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin before 1.42.0 does not bind its Turnstile validation cache to the single-use challenge token in its Forminator integration, instead keying it to an attacker-controlled, reusable request value, allowing unauthenticated attackers to solve one challenge and then replay token-less form submissions for a short window, defeating the anti-abuse protection the plugin provides.
Explanation of Vulnerability in Simple Terms
Simple CAPTCHA with Cloudflare Turnstile versions before 1.42.0 contain an integrity vulnerability that allows an attacker to modify data in transit over the network. No authentication or user interaction is required. The vulnerability does not affect confidentiality or availability. Update to version 1.42.0 or later to resolve this issue.
What an attacker can do
Modify data sent to or from the site without authentication.
Potential impact on your site
An attacker can alter form submissions or CAPTCHA validation responses without needing to log in.
Conditions required to exploit
Network access to intercept or modify traffic between the site and users.
Key dates
External resources
