CVE-2024-13666 Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 5.2.12 - IP-Spoofing
Unauthenticated attackers can spoof IP addresses to bypass form submission restrictions in the Fluent Forms WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-13666?
CVE-2024-13666 is a medium-severity vulnerability in techjewel Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder, published on 22 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 5.2.12 due to insufficient IP address validation and use of user-supplied HTTP headers as a primary method for IP retrieval. This makes it possible for unauthenticated attackers spoof their IP address and submit forms that may have IP-based restrictions.
Weakness: CWE-20
Which versions are affected by CVE-2024-13666?
How do I fix CVE-2024-13666?
No fix has been published for CVE-2024-13666 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-13666 being exploited?
There is no known exploitation of CVE-2024-13666 in the wild and no public exploit code.
Sources
Also known as GHSA-ppvx-gqx9-qrq3.