CVE-2023-0816: medium-severity vulnerability in Formidable Forms
Formidable Forms < 6.1 - IP Spoofing
Published · Updated
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.5epss 0.5%
exploitation probability
0.5%top 58% of all CVEs
observed exploitation
nono source reports it
The Formidable Forms WordPress plugin before 6.1 uses several potentially untrusted headers to determine the IP address of the client, leading to IP Address spoofing and bypass of anti-spam protections.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected products
Unknown · Formidable FormsRelated CVEs — Formidable Forms
In the same product, most dangerous first.
CVE-2023-2877—Formidable Forms < 6.3.1 - Subscriber+ Remote Code ExecutionEPSS 22.5%CVE-2023-1405HIGHFormidable Forms < 6.2 - Unauthenticated PHP Object InjectionEPSS 0.7%CVE-2024-9768MEDIUMFormidable Forms < 6.14.1 - Admin+ Stored XSSEPSS 0.4%CVE-2026-85642HIGHFormidable Forms 6.5 - 6.35 - Unauthenticated Payment Gateway Connect Verification DoSEPSS 0.4%CVE-2026-19857MEDIUMFormidable Forms < 6.35 - Unauthenticated Arbitrary Shortcode Execution via [entry_key] Custom HTML TokenEPSS 0.2%CVE-2026-11361MEDIUMFormidable Forms < 6.32.1 - Unauthenticated Payment Bypass via PayPal APPROVAL_PENDING Subscription StatusEPSS 0.2%