CVE-2025-12094
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-31

Last updated on: 2025-11-04

Assigner: Wordfence

Description
The OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA) plugin for WordPress is vulnerable to IP Header Spoofing in all versions up to, and including, 1.2.53. This is due to the plugin trusting client-controlled forwarded headers (such as CF-Connecting-IP, X-Forwarded-For, and others) without verifying that those headers originate from legitimate, trusted proxies. This makes it possible for unauthenticated attackers to spoof their IP address and bypass IP-based security controls, including blocked IP lists and rate limiting protections, by sending arbitrary HTTP headers with their requests.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-31
Last Modified
2025-11-04
Generated
2026-05-07
AI Q&A
2025-10-31
EPSS Evaluated
2026-05-05
NVD
EUVD
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
wordfence oopspam_anti-spam 1.2.53
wordfence oopspam_anti-spam 1.2.54
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-693 The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?

This vulnerability involves IP header spoofing by sending arbitrary HTTP headers such as CF-Connecting-IP, X-Forwarded-For, and others to bypass IP-based security controls. To detect it on your network or system, you can monitor incoming HTTP requests for suspicious or inconsistent IP header values that do not match the actual source IP address. Commands to help detect this include using network packet capture tools like tcpdump or Wireshark to inspect HTTP headers, for example: 1. tcpdump -i <interface> -A 'tcp port 80 or tcp port 443' | grep -i 'X-Forwarded-For' 2. Using curl with verbose output to test header spoofing: curl -v -H 'X-Forwarded-For: <spoofed-ip>' https://yourwordpresssite.com 3. Checking web server logs for unusual or multiple forwarded IP headers that do not align with REMOTE_ADDR. Additionally, reviewing plugin logs or database entries for spam submissions with suspicious IP addresses may help. However, no specific detection commands are provided in the resources. [2, 3]


What immediate steps should I take to mitigate this vulnerability?

Immediate mitigation steps include updating the OOPSpam Anti-Spam plugin to a version later than 1.2.53 where the IP header spoofing issue is addressed. If an update is not immediately available, you should configure the plugin or your server to not trust client-controlled forwarded headers unless they come from verified, trusted proxies. This can involve disabling the acceptance of headers like CF-Connecting-IP and X-Forwarded-For unless explicitly trusted, as controlled by the plugin's settings or constants such as OOPSPAM_TRUST_PROXY_HEADERS. Additionally, consider implementing server-level protections to validate IP headers or use firewall rules to block suspicious requests. Monitoring and logging suspicious activity can also help in mitigation. [2, 3]


How can this vulnerability impact me? :

This vulnerability can allow attackers to bypass IP-based security measures implemented by the plugin, such as blocked IP lists and rate limiting. As a result, attackers can evade restrictions meant to prevent spam or abuse, potentially leading to increased spam submissions, denial of service, or other malicious activities on your WordPress site.


Can you explain this vulnerability to me?

The vulnerability in the OOPSpam Anti-Spam plugin for WordPress allows an attacker to spoof their IP address by sending arbitrary HTTP headers such as CF-Connecting-IP or X-Forwarded-For. The plugin trusts these client-controlled forwarded headers without verifying if they come from legitimate, trusted proxies. This means an unauthenticated attacker can bypass IP-based security controls like blocked IP lists and rate limiting protections by pretending to have a different IP address.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart