The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin receives a Turnstile challenge token for each form submission but incorrectly stores the response cache based on a reusable request value instead of the one‑time challenge token. This oversight lets an unauthenticated attacker solve a single challenge and then replay the validated result for multiple subsequent form submissions within a short period, effectively bypassing the anti‑abuse protection.

All installations of the Simple CAPTCHA with Cloudflare Turnstile WordPress plugin with a version number earlier than 1.42.0. The vulnerability specifically impacts the Forminator integration of the plugin.

The CVSS score of 5.3 indicates moderate severity. Because the exploit requires only the ability to submit a form, Internet‑connected attackers can exploit this flaw without prior authentication. The EPSS score is 0.00111, indicating a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, yet the attacker's method is straightforward and therefore substantial risk remains.