CVE-2026-15239

The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin prior to version 1.42.0 contains a security flaw in its Forminator integration. An attacker can exploit this vulnerability by solving one challenge and then reusing the resulting token for multiple form submissions, bypassing the anti-abuse protection intended by the plugin. This allows unauthenticated attackers to submit forms without going through the CAPTCHA validation process for a short period of time.

Based on public CVE data (MITRE/NVD).