CVE-2026-40799 RelyWP CVE debrief

Who should care

Defenders and security teams responsible for managing and securing Simple Cloudflare Turnstile plugin installations should assess exposure and prioritize verification and updates.

Why it matters

CVE-2026-40799 is a MEDIUM severity vulnerability in Simple Cloudflare Turnstile plugin versions <= 1.38.0, allowing unauthenticated broken authentication. Defenders should prioritize verifying and updating plugin versions to prevent potential authentication issues.

• Potential authentication issues due to broken authentication in Simple Cloudflare Turnstile plugin versions <= 1.38.0
• Need to verify and update plugin versions to prevent potential authentication issues
• Possible security risks if plugin versions are not updated or properly configured

Technical summary

The vulnerability is a MEDIUM severity issue in Simple Cloudflare Turnstile plugin versions <= 1.38.0, allowing unauthenticated broken authentication. The CVSS score is 5.3.

Defensive priority

Defenders should prioritize verifying and updating Simple Cloudflare Turnstile plugin versions to prevent potential authentication issues.

Recommended defensive actions

• Verify and update Simple Cloudflare Turnstile plugin versions to prevent potential authentication issues
• Review and adjust authentication configurations for the plugin
• Monitor plugin updates and security advisories from the vendor

Evidence notes

The vulnerability is described as unauthenticated broken authentication in Simple Cloudflare Turnstile plugin versions <= 1.38.0. The CVSS score is 5.3, and the severity is MEDIUM.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.