# CVE-2026-40799: RelyWP Simple Cloudflare Turnstile broken authentication

Source: https://junglewise.ai/threats/cve-2026-40799-relywp-simple-cloudflare-turnstile-broken-authentication  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-15. Updated: 2026-06-15  
License: CC BY 4.0 with a link back

CVE-2026-40799 · Severity: medium · CVSS 5.3 · Published 2026-06-15

The Simple Cloudflare Turnstile plugin for WordPress, which is used to protect websites from bots and spam, contains a security flaw that allows unauthorized users to bypass authentication checks. An attacker could exploit this to perform actions that are normally restricted to site administrators or other high-privileged users. This could lead to unauthorized changes on the website or potential account takeover.

Technologies: [RelyWP Simple Cloudflare Turnstile](https://junglewise.ai/threats/technologies/simple-cloudflare-turnstile). Vendors: [RelyWP](https://junglewise.ai/threats/vendors/relywp).

## Quick answers

**Is CVE-2026-40799 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40799 being exploited in the wild.

**How severe is CVE-2026-40799?** Medium severity, with a CVSS score of 5.3, published 15 June 2026.

**Which products and versions are affected?** RelyWP Simple Cloudflare Turnstile <= 1.38.0.

**Is there a fix for CVE-2026-40799?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-40799 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-40799?** Check whether you run RelyWP Simple Cloudflare Turnstile at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A broken authentication vulnerability exists in the Simple Cloudflare Turnstile plugin for WordPress (versions <= 1.38.0) due to an authentication bypass using an alternate path or channel (CWE-288). The flaw allows an unauthenticated remote attacker to bypass intended security restrictions and potentially execute actions with elevated privileges. The root cause involves improper validation of authentication states, which can be exploited over the network without user interaction. A patch is available in version 1.38.1.

## Affected products

- RelyWP Simple Cloudflare Turnstile <= 1.38.0

## Timeline

- 2026-04-08: other: Reported by David Marín
- 2026-05-08: advisory: Initial advisory published by Patchstack
- 2026-06-15: disclosed: NVD publication date

## References

- [https://patchstack.com/database/wordpress/plugin/simple-cloudflare-turnstile/vulnerability/wordpress-simple-cloudflare-turnstile-plugin-1-38-0-broken-authentication-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/simple-cloudflare-turnstile/vulnerability/wordpress-simple-cloudflare-turnstile-plugin-1-38-0-broken-authentication-vulnerability?_s_id=cve)

## Related threats

- [RelyWP Simple Cloudflare Turnstile authentication bypass](https://junglewise.ai/threats/cve-2026-119498-authentication-bypass-using-an-alternate-path-or-channel)
- [RelyWP Simple Cloudflare Turnstile authentication bypass](https://junglewise.ai/threats/cve-2026-57775-authentication-bypass-using-an-alternate-path-or-channel)
- [RelyWP Simple Cloudflare Turnstile broken access control](https://junglewise.ai/threats/cve-2026-39741-missing-authorization-vulnerability-in-relywp-simple-cloudflare)
- [WordPress Simple Cloudflare Turnstile auth bypass](https://junglewise.ai/threats/cve-2026-66674-wordpress-simple-cloudflare-turnstile-auth-bypass)
- [Simple Cloudflare Turnstile content injection](https://junglewise.ai/threats/cve-2026-66632-simple-cloudflare-turnstile-content-injection)