CVE-2026-15239 affects the Simple CAPTCHA with Cloudflare Turnstile WordPress plugin before version 1.42.0. The vulnerability arises because the plugin's Forminator integration keys its Turnstile validation cache to an attacker-controlled, reusable request value instead of the single-use challenge token. This flaw enables unauthenticated attackers to bypass CAPTCHA protections by replaying form submissions without valid tokens after solving a single challenge. The issue is categorized under CWE-345, indicating insufficient verification of data authenticity. The vulnerability has a CVSS 3.1 base score of 5.3 (medium severity). The plugin is a cloud service, and a patch is available to fix the issue.

Attackers can bypass the CAPTCHA anti-abuse mechanism by reusing a solved challenge token to submit multiple token-less form submissions. This undermines the intended protection against automated abuse or spam on forms using the affected plugin. There is no direct confidentiality or availability impact reported, but the integrity of form submission validation is compromised.

A patch is available for Simple CAPTCHA with Cloudflare Turnstile plugin version 1.42.0 and later that fixes this vulnerability. Users should upgrade to version 1.42.0 or newer to remediate the issue. Since this is a cloud service plugin, the vendor manages remediation for the cloud-hosted service. Check the vendor advisory for confirmation and apply the official update promptly.