CVE-2026-15239: 
WordPress vulnerability analysis and mitigation

CVE-2026-15239 is a security feature bypass vulnerability in the Simple CAPTCHA with Cloudflare Turnstile WordPress plugin affecting all versions before 1.42.0. The flaw allows unauthenticated attackers to bypass Turnstile CAPTCHA protection in the plugin's Forminator integration by replaying a previously solved challenge token. It was publicly disclosed on August 3, 2026, and published to the NVD on August 7, 2026. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) (WPScan, GitHub Advisory).

The root cause is classified as CWE-345 (Insufficient Verification of Data Authenticity). The plugin's Turnstile validation cache is keyed to an attacker-controlled, reusable form_uid value (specifically md5(form_id|form_uid)) rather than the single-use Cloudflare Turnstile challenge token. An attacker can submit one valid token to "poison" the cache for a chosen form_uid, then replay token-less form submissions using the same form_uid for up to 5 minutes — the duration of the WordPress transient — because the cache is not cleared on read. The attack targets unauthenticated POST requests to /wp-admin/admin-ajax.php with the forminator_submit_form_custom-forms action, and requires only that the Forminator integration is enabled (cfturnstile_forminator=1) and the admin key-test has been completed (cfturnstile_tested=yes) (WPScan).

Successful exploitation allows unauthenticated attackers to bypass the anti-spam and anti-abuse CAPTCHA protection on any Forminator-powered form for a 5-minute window per solved challenge. This enables automated or bulk form submissions — such as spam, credential stuffing, or fraudulent registrations — without solving additional CAPTCHA challenges. There is no confidentiality or availability impact; the integrity impact is limited to unauthorized form submissions (GitHub Advisory, WPScan).

A proof-of-concept (PoC) is publicly documented in the WPScan advisory, demonstrating the full attack flow across four steps. The NVD SSVC assessment classifies exploitation as having a PoC available and as automatable. No evidence of active in-the-wild exploitation has been reported, and no threat actor attribution exists at this time. The EPSS score is approximately 0.111%, placing it in the 2nd percentile for near-term exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (WPScan, GitHub Advisory).

1. Reconnaissance: Identify WordPress sites using the Simple CAPTCHA with Cloudflare Turnstile plugin (version < 1.42.0) with the Forminator integration enabled (cfturnstile_forminator=1) and admin key-test completed (cfturnstile_tested=yes). Retrieve the public Forminator nonce and form_id from the rendered form page.
2. Baseline check: Send an unauthenticated POST to /wp-admin/admin-ajax.php with action=forminator_submit_form_custom-forms, a chosen attacker-controlled form_uid (e.g., ATTACKER1), and no Turnstile token. Confirm the submission is blocked ("success":false).
3. Cache poisoning: Send a second POST with the same form_uid and one valid (or test dummy) Cloudflare Turnstile token (cf-turnstile-response=XXXX.DUMMY.TOKEN.XXXX). The server validates the token, caches the result keyed to md5(form_id|form_uid), and returns "success":true.
4. Bypass replay: Send repeated POST requests using the same form_uid but with no Turnstile token. The server reads the cached validation result and accepts each submission ("success":true) for up to 5 minutes without requiring additional CAPTCHA solving.
5. Spam/abuse: Use this window to submit spam, fraudulent registrations, or other abusive content through the unprotected form at scale (WPScan).

• Network: High volume of unauthenticated POST requests to /wp-admin/admin-ajax.php with action=forminator_submit_form_custom-forms; repeated requests sharing the same form_uid parameter value with no cf-turnstile-response field after an initial submission that included one.
• Logs: WordPress access logs showing bursts of form submission requests from the same IP or user-agent with identical form_uid values; successful form submissions ("success":true) immediately following a single token-bearing submission.
• Application: Unusual volume of Forminator form entries in the WordPress database within short time windows; form entries lacking associated Turnstile token metadata (WPScan).

Update the Simple CAPTCHA with Cloudflare Turnstile WordPress plugin to version 1.42.0 or later, which binds the Turnstile validation cache to the single-use challenge token rather than the attacker-controlled form_uid value. If immediate patching is not possible, consider disabling the Forminator integration (cfturnstile_forminator=1) or restricting affected forms to authenticated users only until the patch can be applied. Site administrators can also monitor Forminator submission logs for anomalous patterns as a temporary detective control (WPScan, GitHub Advisory).

The vulnerability was discovered and submitted by independent researcher Meher Sudhakar Abbireddi, who also authored the proof-of-concept. WPScan verified the report and published the advisory. No significant broader media coverage or notable social media commentary has been identified beyond standard vulnerability database aggregation (WPScan).