CVE-2026-15239

Executive Summary

CVE-2026-15239 is a Medium-severity authentication bypass vulnerability in the Simple CAPTCHA with Cloudflare Turnstile WordPress plugin (versions before 1.42.0). The plugin's Forminator integration improperly caches Turnstile validation results using an attacker-controlled, reusable request value instead of binding the cache to the single-use challenge token. This flaw allows unauthenticated attackers to solve a single CAPTCHA challenge and then replay token-less form submissions for a short time window, effectively bypassing the anti-abuse protection. Enterprise WordPress deployments using Forminator with Turnstile CAPTCHA are affected, with the primary impact being spam abuse, account creation fraud, and potential business logic abuse behind protected forms.

Technical Analysis

The vulnerability resides in the Simple CAPTCHA with Cloudflare Turnstile plugin's integration with the Forminator form builder. The core flaw is a cache-key design error classified under CWE-345 (Insufficient Verification of Data Authenticity).

Vulnerability Mechanism:

When a user submits a Forminator form protected by Turnstile, the plugin performs the following sequence:

1. Challenge Generation: Cloudflare Turnstile issues a one-time cf-turnstile-response token to the client after successful human verification.
2. Server-Side Validation: The plugin receives this token and forwards it to Cloudflare's /siteverify API endpoint for validation.
3. Result Caching: The plugin caches the validation result to avoid redundant API calls. The critical flaw is what key is used for this cache entry.

Instead of using the unique, single-use cf-turnstile-response token (or a hash thereof) as the cache key, the plugin keys the cache to an attacker-controlled, reusable request value — such as the form ID, a session identifier, or an IP-derived value present in the HTTP request.

Attack Surface:

• Pre-Authentication: The vulnerability is exploitable by unauthenticated attackers (AV:N, PR:N, UI:N per CVSS).
• Forminator Integration: Only forms using the Forminator integration path are affected.
• WordPress Deployment: Any self-hosted WordPress installation running the plugin before version 1.42.0.

Code-Level Explanation (Hypothetical Reconstruction):

// Vulnerable pattern (simplified)
$cache_key = 'turnstile_' . sanitize_text_field($_POST['form_id']); // Reusable, attacker-controlled
$cached_result = wp_cache_get($cache_key);

if ($cached_result === false) {
    $result = turnstile_verify($_POST['cf-turnstile-response']);
    wp_cache_set($cache_key, $result, '', 300); // 5-minute cache window
}

if ($cached_result === true || $result === true) {
    // Process form submission
}

The attacker crafts requests where the cache key (form_id or similar) remains constant while omitting the cf-turnstile-response token entirely. After the first legitimate (or attacker-solved) challenge populates the cache, subsequent submissions bypass validation entirely.

Exploitation Scenarios

Attack Chain — Turnstile Bypass via Cache Replay:

Step 1: Target Reconnaissance

• The attacker identifies WordPress sites running the vulnerable plugin via fingerprinting (e.g., detecting Cloudflare Turnstile assets in page source, checking for Forminator forms, or scanning for /wp-content/plugins/simple-cloudflare-turnstile/ directory).
• The attacker maps the target form's structure, identifying the form_id parameter and submission endpoint (typically wp-admin/admin-ajax.php or a custom REST endpoint).

Step 2: Seed the Cache

• The attacker navigates to the target form and completes the Turnstile challenge once — either manually (solving a standard puzzle) or via CAPTCHA-solving services (cost: ~$0.50–$3 per thousand solved).
• The attacker captures the valid cf-turnstile-response token and the associated form_id from the intercepted request.

Step 3: Replay and Pivot (the attack)

• The attacker submits a crafted POST request to the form endpoint. The request contains the normal form fields but omits the cf-turnstile-response token.
• The attacker ensures the request includes the same cache-key value (e.g., form_id=123) that was seeded in Step 2.
• The plugin's cache lookup returns the previously stored "valid" result, and the form is processed as if the CAPTCHA was freshly solved.
• The attacker repeats this process for every form submission within the cache TTL window (typically 5 minutes, but may vary based on plugin configuration).

Step 4: Scale and Automate

• Using a scripted loop, the attacker sends hundreds or thousands of submissions within the cache window.
• To extend the attack, the attacker re-seeds the cache every few minutes by solving a new challenge, maintaining a perpetual bypass.

Step 5: Post-Exploitation Impact

• Spam Campaigns: Mass-submit contact forms, comment forms, or registration forms without CAPTCHA enforcement.
• Account Fraud: Bulk-create accounts on membership sites, forums, or e-commerce platforms.
• Lead Generation Abuse: Poison CRM systems with fake leads, wasting sales team resources.
• Business Logic Attacks: Abuse forms tied to password resets, ticket systems, or quota-limited features.

Impact Assessment

CVSS Analysis: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N — Score 5.3 (Medium)

• Attack Vector (AV:N): Exploitable over the network; no physical or local access required.
• Attack Complexity (AC:L): Low complexity; no special conditions beyond having a CAPTCHA token (obtainable via solving services).
• Privileges Required (PR:N): None — fully unauthenticated.
• User Interaction (UI:N): None — no victim interaction needed after the initial cache seeding.
• Impact: Integrity impact (I:L) — the attacker gains the ability to submit arbitrary data to protected forms, but confidentiality (C:N) and availability (A:N) are unaffected.

Business Impact:

• Spam & Abuse: Degrades the quality of form-submitted data, increasing operational costs for triage and cleanup.
• Brand Reputation: If abused forms generate fake orders, account creations, or inquiries, customers and partners may lose trust.
• Compliance Risk: For forms handling PII, an influx of bogus submissions may make data quality audits harder, though no data exfiltration occurs.
• Resource Exhaustion: In high-volume abuse scenarios, the email/SMS notification systems triggered by form submissions may be overwhelmed, leading to denial-of-service for legitimate communications.

Blast Radius:

• Affected Systems: All WordPress sites running Simple CAPTCHA with Cloudflare Turnstile < 1.42.0 with Forminator active.
• Geographic Spread: Global, given WordPress's ubiquity.
• Limitation: The vulnerability does not expose data, compromise the server, or provide code execution — its impact is confined to CAPTCHA bypass.

Detection Guidance

Sigma Rule

title: WordPress Turnstile Plugin Cache Bypass - Reusable Form Key Abuse
id: 7f3c9a2e-8b1d-4d5e-9c4a-6b2e1f8a3d42
status: experimental
description: Detects repeated form submissions without Turnstile tokens to the same Forminator form ID within a short window, indicating potential cache-key reuse attacks.
author: Valtersit Threat Intelligence
date: 2026/01/15
logsource:
  category: webserver
  product: apache
  detection:
    selection:
      cs-method: 'POST'
      cs-uri-query|contains:
        - 'admin-ajax.php'
        - 'wp-json'
    filter_no_turnstile:
      sc-params|contains: 'cf-turnstile-response'
    filter_normal_forms:
      cs-uri-query|contains: 'action=forminator_submit_form'
    condition: selection and not filter_no_turnstile and filter_normal_forms
    timeframe: 30s
  level: medium
  tags:
    - attack.initial-access
    - attack.t1078
    - cve.2026-15239

YARA Rule

rule Wordpress_Turnstile_Cache_Bypass_CVE_2026_15239
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects suspicious PHP code patterns in Simple CAPTCHA with Cloudflare Turnstile plugin that may indicate cache-key reuse vulnerabilities"
        date = "2026-01-15"
        cve = "CVE-2026-15239"
        severity = "medium"
    strings:
        $cache_fn = "wp_cache_" ascii nocase
        $turnstile_token = "cf-turnstile-response" ascii nocase
        $form_id_var = "form_id" ascii nocase
        $siteverify = "siteverify" ascii nocase
        $cache_ttl = "300" ascii
    condition:
        uint16(0) == 0x5A4D or uint32(0) == 0x504B0304 and
        2 of ($cache_fn, $siteverify) and
        $turnstile_token and
        $form_id_var and
        #cache_ttl >= 1
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-15239 - WordPress Turnstile Cache Bypass Attempt"; flow:established,to_server; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=forminator_submit_form"; http_uri; content:!"cf-turnstile-response"; http_client_body; http_client_body; nocase; sid:202615239; rev:1; metadata:created_at 2026_01_15, updated_at 2026_01_15, cve CVE-2026-15239;)

Note: This rule is intentionally broad due to the nature of the attack — the distinguishing factor is the absence of the Turnstile token combined with Forminator submission. Tuning is required to reduce false positives (e.g., require multiple rapid submissions from the same IP).

Elastic Detection

// EQL query for Elastic Security
sequence by source.ip with maxspan=30s
  [network where process.name == "httpd" or process.name == "nginx" and
   network.protocol == "http" and http.request.method == "POST" and
   http.request.body.content_type == "application/x-www-form-urlencoded" and
   http.request.uri.path like "*/admin-ajax.php" and
   not http.request.body.content like "*cf-turnstile-response*" and
   http.request.body.content like "*action=forminator_submit_form*"]
  [network where process.name == "httpd" or process.name == "nginx" and
   network.protocol == "http" and http.request.method == "POST" and
   http.request.uri.path like "*/admin-ajax.php" and
   not http.request.body.content like "*cf-turnstile-response*" and
   http.request.body.content like "*action=forminator_submit_form*"]

Splunk SPL Query

index=web sourcetype=access_combined
| where method="POST"
| spath input=uri_path output=uri_path
| where uri_path LIKE "%admin-ajax.php%" OR uri_path LIKE "%wp-json%"
| search NOT form_data="*cf-turnstile-response*"
| regex form_data=".*action=forminator_submit_form.*"
| stats count as submission_count by src_ip, uri_query, _time
| where submission_count > 5
| eval severity=case(submission_count > 50, "CRITICAL", submission_count > 20, "HIGH", submission_count > 5, "MEDIUM")
| table _time, src_ip, uri_query, submission_count, severity
| sort -submission_count

Wazuh OSSEC Rule

<group name="web,wordpress,">
  <rule id="778386" level="8">
    <decoded_as>json</decoded_as>
    <field name="url">\.*admin-ajax\.php|\.*wp-json\.*</field>
    <field name="method">POST</field>
    <description>CVE-2026-15239: WordPress Turnstile form submission without CAPTCHA token</description>
    <group>cve-2026-15239</group>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
  
  <rule id="778387" level="12">
    <if_sid>1523901</if_sid>
    <field name="data">action=forminator_submit_form</field>
    <description>CVE-2026-15239: Possible Turnstile cache bypass - Forminator submission without token</description>
    <group>cve-2026-15239</group>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
  
  <rule id="778388" level="15" frequency="10" timeframe="60">
    <if_matched_sid>1523902</if_matched_sid>
    <description>CVE-2026-15239: Repeated Turnstile bypass attempts detected - possible spam campaign</description>
    <group>cve-2026-15239</group>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence Assessment: 2/4 (CLAIMED — single source claims patch, not independently confirmed). The NVD record references a fixed version of 1.42.0, but this has not been independently verified against vendor changelogs or CVE databases.

1) Immediate Mitigations (before patching)

• Disable Forminator Integration: In the plugin settings, disable the Forminator integration or switch to the standalone Turnstile widget mode until patched.
• Deploy WAF Rules: Create virtual patching rules in your WAF to block form submissions to Forminator endpoints that omit the cf-turnstile-response parameter:

  // ModSecurity example
  SecRule REQUEST_METHOD "@streq POST" "id:15239,phase:2,deny,t:urlDecode,chain"
  SecRule REQUEST_URI "@contains admin-ajax.php" "chain"
  SecRule ARGS:action "@streq forminator_submit_form" "chain"
  SecRule &ARGS:cf-turnstile-response "@eq 0" "msg:'CVE-2026-15239 - Turnstile token missing',log,auditlog,deny,status:403"
  

• Implement Rate Limiting: Add IP-based rate limiting to form submission endpoints to limit blast radius.
• Monitor Logs: Enable the detection queries above and alert on anomaly patterns.

2) Patch/Upgrade Steps

• Verify Patch Availability: Check the WordPress plugin repository for version 1.42.0 or newer. Confirm with the vendor changelog.
• Upgrade Procedure:
  1. Take a full WordPress backup (database + files).
  2. Navigate to wp-admin/plugin-install.php → Search for "Simple CAPTCHA with Cloudflare Turnstile".
  3. Click "Update Now" or manually download and replace the plugin directory via FTP/SFTP.
  4. Verify the installed version shows ≥ 1.42.0.
  5. Clear any object caches (wp_cache_flush() or Memcached/Redis purge).
  6. Re-test a Forminator form to confirm CAPTCHA enforcement works correctly.
• If patch is unavailable (unconfirmed): Monitor the vendor's release channel and apply as soon as released.

3) Long-Term Hardening

• Broader CAPTCHA Strategy: Evaluate using dedicated CAPTCHA plugins with better security track records, or implement server-side Turnstile verification in custom code.
• Cache Security Review: If you rely on object caching (Redis/Memcached), audit cache key design — ensure single-use tokens are used as key components for security-critical validations.
• WordPress Security Baseline:
  • Enable automatic updates for plugins (DISALLOW_FILE_MODS off or use a managed WP provider).
  • Conduct quarterly plugin vulnerability audits using tools like WPScan or Patchstack.
  • Deploy a Web Application Firewall (Cloudflare, Sucuri, Wordfence) for defense-in-depth.
• Monitoring Improvements: Integrate the detection logic from this report into your SIEM/EDR stack permanently, not just for this CVE, as similar cache-keys flaws are common in WordPress plugins.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-15239
2. WordPress Plugin Repository (Simple CAPTCHA with Cloudflare Turnstile): https://wordpress.org/plugins/simple-cloudflare-turnstile/
3. Cloudflare Turnstile Documentation (for validation logic reference): https://developers.cloudflare.com/turnstile/get-started/server-side-validation/
4. Forminator Plugin Page (integration context): https://wordpress.org/plugins/forminator/
5. CWE-345 Reference: https://cwe.mitre.org/data/definitions/345.html

Threat Actor Campaign Evidence: As of the date of this report, there are no publicly documented exploit-in-the-wild campaigns targeting CVE-2026-15239. The CVE is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. However, given the low exploitation complexity and the popularity of WordPress form plugins, security teams should expect opportunistic spam botnets to incorporate this bypass into their tooling shortly after it gains traction in security communities. Historical context shows similar CAPTCHA bypass flaws are typically weaponized within 30–60 days of public disclosure.