Medium severity · published Mar 27, 2023
CVE-2023-0816
The Formidable Forms WordPress plugin before 6.1 uses several potentially untrusted headers to determine the IP address of the client, leading to IP Address spoofing and bypass of…
6.5
CVSS
0.5%
EPSS
No
On KEV
Description
The Formidable Forms WordPress plugin before 6.1 uses several potentially untrusted headers to determine the IP address of the client, leading to IP Address spoofing and bypass of anti-spam protections.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FF
Formidable Form Builder · Strategy11
before 6.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-0816
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-0816
Exploit
https://wpscan.com/vulnerability/a281f63f-e295-4666-8a08-01b23cd5a744
More from Formidable Form Builder
9.8
CVE-2019-15780
The formidable plugin before 4.02.01 for WordPress has unsafe deserialization
9.6
CVE-2021-24884
The Formidable Form Builder WordPress plugin before 4.09.05 allows to inject certain HTML Tags like <audio>,<video>,<img>,<a> and<button>.This could allow an unauthenticated,…
8.8
CVE-2023-24419
Cross-Site Request Forgery (CSRF) vulnerability in Strategy11 Form Builder Team Formidable Forms plugin <= 5.5.6 versions
6.1
CVE-2017-20192
Formidable Form Builder < 2.05.03 - Unauthenticated Stored Cross-Site Scripting
6.1
CVE-2023-6830
The Formidable Forms plugin for WordPress is vulnerable to HTML injection in versions up to, and including, 6.7