Live › vulnerability › CVE-2026-85642
Go to dashboardThe Formidable Forms WordPress plugin before 7.0 does not check who is calling before it records the timestamp used to rate limit payment gateway verification requests. An unauthenticated attacker can use up the daily allowance, so legitimate payment verification attempts are refused for 24 hours.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Formidable Forms plugin before 7.0 that use its payment gateway verification feature are exposed, because the rate limit can be exhausted by anonymous requests. Sites without the plugin or with payment verification turned off are unlikely to be affected; the sources do not say which gateway configurations are required.
No product ranges from the sources yet.
wp plugin get formidable --field=version; versions below 7.0 are in scope.7.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Formidable Forms WordPress plugin before 7.0 does not verify the identity of the caller before recording the timestamp it uses to rate limit payment gateway verification requests, allowing unauthenticated attackers to consume the daily allowance and cause legitimate verification attempts to be refused for the next 24 hours.
This page as .md · .json · in your agent: get_signal("CVE-2026-85642")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.