7.5
High
CVE-2026-85642 The Formidable Forms WordPress plugin before 7.0 does not verify the identity of the caller before recording the…
Description
The Formidable Forms WordPress plugin before 7.0 does not verify the identity of the caller before recording the timestamp it uses to rate limit payment gateway verification requests, allowing unauthenticated attackers to consume the daily allowance and cause legitimate verification attempts to be refused for the next 24 hours.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Formidable Forms 6.5 | 6.5 → < 7.0 | 7.0 |
Other CVEs of Formidable Forms
The 8 CVEs of Formidable Forms →
CVE-2026-19857
The Formidable Forms WordPress plugin before 6.35 does not prevent a request-derived value from reaching the WordPress…
4.8
Medium
CVE-2026-85641
The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user…
4.3
Medium
CVE-2026-11361
The Formidable Forms WordPress plugin before 6.32.1 does not properly validate the status of a PayPal subscription…
5.9
Medium
CVE-2024-9768
The Formidable Forms WordPress plugin before 6.14.1 does not sanitise and escape some of its settings, which could…
4.8
Medium