CVE-2026-66632: WordPress Simple Cloudflare Turnstile plugin <= 1.42.1 - Content Injection vulnerability
Published Sep 10, 2026
·Updated
Unauthenticated Content Injection in Simple Cloudflare Turnstile <= 1.42.1 versions.
Affected Software
1 affected component
WordPress Simple Cloudflare Turnstile plugin<=1.42.1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Simple Cloudflare Turnstile pluginto a version that resolves this vulnerability.Fixed in 1.42.3
Event History
Sep 10, 2026
CVE Published
via MITRE·02:23 PM
Data Sourced
via MITRE·02:23 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
The vulnerability is unauthenticated and has no user-interaction requirement, so a remote attacker does not need a WordPress account or victim action to attempt exploitation.
2
What security impact is reported?
The reported impact is limited confidentiality and integrity impact, with no availability impact indicated. The vulnerability is classified as code injection/content injection.