CVE-2026-85642 Details
Description
The Formidable Forms WordPress plugin before 7.0 does not verify the identity of the caller before recording the timestamp it uses to rate limit payment gateway verification requests, allowing unauthenticated attackers to consume the daily allowance and cause legitimate verification attempts to be refused for the next 24 hours.
A denial-of-service vulnerability has been identified in the Formidable Forms WordPress plugin, affecting versions prior to 7.0. The issue arises because the plugin does not verify the identity of the caller before recording timestamps used to rate limit payment gateway verification requests. This lack of authentication allows unauthenticated attackers to exhaust the daily allowance for verification attempts, causing legitimate requests to be denied for the next 24 hours.
Users are advised to update the Formidable Forms WordPress plugin to version 7.0 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 21, 2026CISA-ADP
Assessed Oct 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/6bdc69fa-7db1-4790-9147-30ebd03580b0/ | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Formidable Forms | >= 6.5, <= 6.35 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 21, 2026 | CVE Modified | CISA-ADP |
| Oct 21, 2026 | New CVE Received | [email protected] |