Forminator Turnstile verification can be replayed through an attacker-controlled cache key
Simple CAPTCHA with Cloudflare Turnstile before 1.42.0 caches successful Forminator validation for five minutes using attacker-controlled POST parameter form_uid rather than the single-use Turnstile token. After solving one challenge, an unauthenticated attacker can reuse the same form_uid in token-less submissions; cfturnstile_forminator_check() finds the cached success before token extraction and accepts the requests until the cache expires. This permits repeated spam or automated use of the protected form, while additional impact depends on the form's configured actions. Version 1.42.0 binds the short validation cache to the verified token instead.
- Component
- Simple CAPTCHA with Cloudflare Turnstile
- Plugin slug
simple-cloudflare-turnstile- Affected
- < 1.42.0
- Safe version
1.42.0- Published
- Aug 07, 2026
This CVE was published Aug 07, 2026 and is one of 6 known issues for this plugin.
Update, patch or deactivate.
Update Simple CAPTCHA with Cloudflare Turnstile to 1.42.0 or later. Review public Forminator submissions made on vulnerable releases for bursts reusing one form_uid, especially requests without a corresponding Turnstile token, and disable the integration until updated if abuse is active.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin before 1.42.0 does not bind its Turnstile validation cache to the single-use challenge token in its Forminator integration, instead keying it to an attacker-controlled, reusable request value, allowing unauthenticated attackers to solve one challenge and then replay token-less form submissions for a short window, defeating the anti-abuse protection the plugin provides.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N