CVE Database /
CVE-2023-0816
CVE · Medium
CVE-2023-0816 — Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More [formidable] < 6.1
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2023-0816
|
Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More [formidable] < 6.1 |
Authentication Bypass by Spoofing |
Medium
6.5
|
< 6.1
|
6.1 |
2023-03-06 |
—
|
CVE-2023-0816
The Formidable Forms plugin through version 6.0.1 contains an IP spoofing vulnerability that arises from trusting unverified HTTP headers like Client-Ip and CF-CONNECTING-IP when determining a user's IP address during form submissions. An unauthenticated attacker can exploit this flaw by forging these headers to spoof their IP address, allowing them to circumvent the plugin's spam prevention mechanisms. The vulnerability affects all versions up to and including 6.0.1, with fixes available in version 6.1 and later.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings