CVE-2023-0816 Formidable Forms < 6.1 - IP Spoofing
Attackers can spoof IP addresses via untrusted headers to bypass anti-spam protections in the Formidable Forms WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-0816?
CVE-2023-0816 is a medium-severity vulnerability in Unknown Formidable Forms, published on 27 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Formidable Forms WordPress plugin before 6.1 uses several potentially untrusted headers to determine the IP address of the client, leading to IP Address spoofing and bypass of anti-spam protections.
Weakness: CWE-290
Which versions are affected by CVE-2023-0816?
It affects 1 product.
Products include Strategy11 Formidable Form Builder.
How do I fix CVE-2023-0816?
No fix has been published for CVE-2023-0816 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-0816 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-0816 exists.
Other vulnerabilities in Unknown Formidable Forms
- CVE-2019-15780 Deserialization in n/a
- CVE-2021-24884 Formidable Form Builder < 4.09.05 - Unauthenticated Stored Cross-Site Scripting
- CVE-2017-20192 Formidable Form Builder < 2.05.03 - Unauthenticated Stored Cross-Site Scripting
- CVE-2023-24419 WordPress Formidable Forms Plugin <= 5.5.6 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-6830 Formidable Forms <= 6.7 - HTML Injection
Sources
Also known as GHSA-m9ch-6hh2-gc9w.