The vulnerability is an authentication bypass that allows an attacker to abuse authentication mechanisms in the RelyWP Simple Cloudflare Turnstile WordPress plugin. This flaw permits unauthorized users to gain privileged access, potentially creating a pathway to alter site content or assume administrative control. The weakness is rooted in CWE‑288, where an alternative path or channel bypasses normal authentication checks.

Any WordPress installation using the RelyWP Simple Cloudflare Turnstile plugin with a version from the earliest released build through 1.44.1 is affected. Administrators and developers should verify the exact plugin version installed and determine whether it falls within this range.

The CVSS score of 5.3 places this vulnerability in the moderate severity range, indicating that while exploitation is feasible, it may require some prerequisites such as an unprotected authentication route. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is inferred to be remote, via the plugin’s alternate authentication path, enabling attackers to gain unauthorized access to the WordPress site if the plugin is not patched.