CVE-2026-85642: high-severity vulnerability in Formidable Forms
Formidable Forms 6.5 - 6.35 - Unauthenticated Payment Gateway Connect Verification DoS
Published
41Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 7.5epss 0.4%
exploitation probability
0.4%top 67% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
The Formidable Forms WordPress plugin before 7.0 does not verify the identity of the caller before recording the timestamp it uses to rate limit payment gateway verification requests, allowing unauthenticated attackers to consume the daily allowance and cause legitimate verification attempts to be refused for the next 24 hours.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Unknown · Formidable Formspublic PoCs found — 1
cve_referencewpscan.com/vulnerability/6bdc69fa-7db1-4790-9147-30ebd03580b0/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Formidable Forms
In the same product, most dangerous first.
CVE-2023-2877—Formidable Forms < 6.3.1 - Subscriber+ Remote Code ExecutionEPSS 22.5%CVE-2023-1405HIGHFormidable Forms < 6.2 - Unauthenticated PHP Object InjectionEPSS 0.7%CVE-2023-0816MEDIUMFormidable Forms < 6.1 - IP SpoofingEPSS 0.5%CVE-2024-9768MEDIUMFormidable Forms < 6.14.1 - Admin+ Stored XSSEPSS 0.4%CVE-2026-19857MEDIUMFormidable Forms < 6.35 - Unauthenticated Arbitrary Shortcode Execution via [entry_key] Custom HTML TokenEPSS 0.2%CVE-2026-11361MEDIUMFormidable Forms < 6.32.1 - Unauthenticated Payment Bypass via PayPal APPROVAL_PENDING Subscription StatusEPSS 0.2%