{"id":"CVE-2026-85642","kind":"vulnerability","aliases":["CVE-2026-85642"],"related":[],"title":"Formidable Forms WordPress plugin: unauthenticated users can block payment verification","description":"The Formidable Forms  WordPress plugin before 7.0 does not verify the identity of the caller before recording the timestamp it uses to rate limit payment gateway verification requests, allowing unauthenticated attackers to consume the daily allowance and cause legitimate verification attempts to be refused for the next 24 hours.","summary":"The Formidable Forms WordPress plugin before 7.0 does not check who is calling before it records the timestamp used to rate limit payment gateway verification requests. An unauthenticated attacker can use up the daily allowance, so legitimate payment verification attempts are refused for 24 hours.","severity":"high","cvss":7.5,"epss":0.00287,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["formidable-forms","package","payments","wordpress"],"not_affected_if":["no-payment-gateway","plugin-version-7.0-or-later"],"how_to_check":"- Check the installed Formidable Forms version in the WordPress admin plugins list or with `wp plugin get formidable --field=version`; versions below `7.0` are in scope.","fix":"- Update the Formidable Forms plugin to `7.0` or later.","status":"open","published_at":"2026-10-21T06:16:50+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:16:58+00:00","updated_at":"2026-10-25T03:16:58+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:16:58Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Formidable Forms plugin to `7.0` or later.","reach":"internet","title":"Formidable Forms WordPress plugin: unauthenticated users can block payment verification","impact":"low","summary":"The Formidable Forms WordPress plugin before 7.0 does not check who is calling before it records the timestamp used to rate limit payment gateway verification requests. An unauthenticated attacker can use up the daily allowance, so legitimate payment verification attempts are refused for 24 hours.","category":"package","nicknames":[],"who_cares":["wordpress","formidable-forms","payments"],"confidence":0.7,"needs_auth":"no","worst_case":"Legitimate payment verification is blocked for 24 hours","analyst_note":"","how_to_check":"- Check the installed Formidable Forms version in the WordPress admin plugins list or with `wp plugin get formidable --field=version`; versions below `7.0` are in scope.","needs_analyst":false,"not_affected_if":["plugin-version-7.0-or-later","no-payment-gateway"],"who_is_affected":"Sites running the Formidable Forms plugin before 7.0 that use its payment gateway verification feature are exposed, because the rate limit can be exhausted by anonymous requests. Sites without the plugin or with payment verification turned off are unlikely to be affected; the sources do not say which gateway configurations are required.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000594,"input_tokens":3361,"output_tokens":516,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-85642':13A,16A '24':66B,115C '7.0':29B,74C 'allow':57B,96C,103C 'attack':51B,98C 'attempt':62B,108C 'block':8A 'call':35B 'caller':82C 'caus':105C 'check':32B 'consum':100C 'cve':11A,14A 'daili':56B,102C 'form':2A,19B,25B,70C 'formid':1A,18B,24B,69C 'formidable-form':17B 'gateway':46B,93C 'hour':67B,116C 'ident':79C 'legitim':59B,106C 'limit':44B,91C 'next':114C 'packag':20B 'payment':9A,21B,45B,60B,92C 'plugin':4A,27B,72C 'rate':43B,90C 'record':38B,84C 'refus':64B,111C 'request':48B,95C 'timestamp':40B,86C 'unauthent':5A,50B,97C 'use':41B,53B,88C 'user':6A 'verif':10A,47B,61B,94C,107C 'verifi':77C 'wordpress':3A,22B,26B,71C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Formidable Forms plugin before 7.0 that use its payment gateway verification feature are exposed, because the rate limit can be exhausted by anonymous requests. Sites without the plugin or with payment verification turned off are unlikely to be affected; the sources do not say which gateway configurations are required.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T06:16:50+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-85642","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85642","severity":null,"published_at":"2026-10-21T06:16:50+00:00","modified_at":"2026-10-21T18:37:38+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-85642","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85642","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}