CVE-2023-0816: Formidable Forms < 6.1 - IP Spoofing

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-03-27 · updated 2026-06-17
Weakness: CWE-290

Description

The Formidable Forms WordPress plugin before 6.1 uses several potentially untrusted headers to determine the IP address of the client, leading to IP Address spoofing and bypass of anti-spam protections.

Affected products

strategy11team Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder: before 6.1 — fixed in 6.1

How to fix

Upgrade to a fixed version: strategy11team Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder 6.1. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/a281f63f-e295-4666-8a08-01b23cd5a744
https://wpscan.com/vulnerability/a281f63f-e295-4666-8a08-01b23cd5a744

Get alerted when CVE-2023-0816 or the next vulnerability affects your stack