The vulnerability lies in the Simple CAPTCHA with Cloudflare Turnstile WordPress plugin. It permits unauthenticated users to execute any shortcode that has been registered on the site. When a visitor submits a form, the plugin parses the entire form, including user input, through the shortcode parser. Because user‑supplied data may contain arbitrary shortcodes, an attacker can trigger the execution of those shortcodes with no authentication, potentially leading to code execution, data exfiltration, or other unintended behavior. The weakness is a form of code injection, most closely aligned with CWE‑94.

Affected products include the Simple CAPTCHA with Cloudflare Turnstile WordPress plugin, versions 1.2.2 through 1.42.2. The vulnerability is present in any release prior to 1.42.3, as released by the plugin author listed under the CNA section. Users running any of these versions are susceptible.

The CVSS base score is 6.5, indicating medium severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, suggesting no known public exploits. Despite the lack of public exploitation evidence, the flaw allows direct execution of arbitrary shortcodes without authentication, so the risk of a successful attack is significant. The likely attack vector involves submitting a crafted form submission through Contact Form 7; an attacker does not need privileged access or any special credentials to exploit the flaw.