CVE-2026-85642

Deferred Deferred - Pending Action

Unauthenticated Rate Limiting Bypass in Formidable Forms

Publication date: 2026-10-21

Last updated on: 2026-10-21

Assigner: WPScan

Description

The Formidable Forms WordPress plugin before 7.0 does not verify the identity of the caller before recording the timestamp it uses to rate limit payment gateway verification requests, allowing unauthenticated attackers to consume the daily allowance and cause legitimate verification attempts to be refused for the next 24 hours.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-21

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-85642

EUVD

EUVD-2026-107084

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	Formidable Forms	6.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

The vulnerability in Formidable Forms before version 7.0 allows unauthenticated attackers to exploit a missing identity check in the payment gateway verification process. By sending unauthorized requests, attackers can consume the daily rate limit, causing legitimate verification attempts to be blocked for 24 hours.

Detection Guidance

Check the installed version of Formidable Forms using WordPress admin panel or run: wp plugin list | grep formidable. If the version is between 6.5 and 6.35, the system is vulnerable.

Impact Analysis

If you use Formidable Forms versions 6.5 to 6.35, attackers could disrupt your payment verification by consuming the daily rate limit. This may prevent legitimate transactions from being processed for up to 24 hours.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it involves a rate-limiting bypass in a WordPress plugin. However, if payment processing is disrupted due to blocked verification attempts, it could indirectly impact data integrity or availability requirements under these regulations.

Mitigation Strategies

Update Formidable Forms to version 7.0 or later immediately. Disable the plugin temporarily if an update is not possible. Monitor rate limit errors in payment gateway logs for unusual activity.

Hi! I’m here to help you understand CVE-2026-85642. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...