Description
The OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA) plugin for WordPress is vulnerable to IP Header Spoofing in all versions up to, and including, 1.2.53. This is due to the plugin trusting client-controlled forwarded headers (such as CF-Connecting-IP, X-Forwarded-For, and others) without verifying that those headers originate from legitimate, trusted proxies. This makes it possible for unauthenticated attackers to spoof their IP address and bypass IP-based security controls, including blocked IP lists and rate limiting protections, by sending arbitrary HTTP headers with their requests.
INFO
Published Date :
2025-10-31T08:25:55.153Z
Last Modified :
2025-10-31T14:18:40.788Z
Source :
Wordfence
AFFECTED PRODUCTS
The following products are affected by CVE-2025-12094 vulnerability.
| Vendors | Products |
|---|---|
| Oopspam |
|
| Wordpress |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2025-12094.
