Missing authorization prevents the WordPress Simple Cloudflare Turnstile plugin from enforcing proper access controls, enabling users to bypass restrictions intended for privileged roles. An attacker could use any exposed plugin functionality—such as configuration changes or sensitive data retrieval—without the necessary authorization checks. This results in unauthorized access to plugin features and potentially to underlying site data.

The vulnerability affects RelyWP's Simple Cloudflare Turnstile plugin on WordPress sites. All releases from the first version up through 1.44.0 are impacted, meaning any site running those plugin versions is susceptible.

The CVSS score of 5.3 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited reported exploitation activity. The attack vector is web-based and likely requires access to the plugin’s administrative interfaces or endpoints; unauthorized users or those with limited privileges could exploit the missing checks to gain escalated access.