CVE-2026-15239

score

0.1

cvss

5.3

epss

0.2%

published

2026-08-07

kev added

—

first seen

2026-10-21

Simple CAPTCHA with Cloudflare Turnstile WordPress plugin < 1.42.0 contains a broken authentication caused by improper binding of Turnstile validation cache to single-use challenge token in Forminator integration, letting unauthenticated attackers bypass anti-abuse protection by replaying token-less form submissions.