---
id: "CVE-2026-85642"
kind: "vulnerability"
aliases: ["CVE-2026-85642"]
title: "Formidable Forms WordPress plugin: unauthenticated users can block payment verification"
severity: "high"
cvss: 7.5
epss: 0.00287
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["formidable-forms", "package", "payments", "wordpress"]
not_affected_if: ["no-payment-gateway", "plugin-version-7.0-or-later"]
published_at: "2026-10-21T06:16:50+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T03:16:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85642", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-85642", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Formidable Forms WordPress plugin: unauthenticated users can block payment verification

The Formidable Forms WordPress plugin before 7.0 does not check who is calling before it records the timestamp used to rate limit payment gateway verification requests. An unauthenticated attacker can use up the daily allowance, so legitimate payment verification attempts are refused for 24 hours.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Formidable Forms version in the WordPress admin plugins list or with `wp plugin get formidable --field=version`; versions below `7.0` are in scope.

## Fix

- Update the Formidable Forms plugin to `7.0` or later.

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-85642
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-85642

## From the sources

The Formidable Forms  WordPress plugin before 7.0 does not verify the identity of the caller before recording the timestamp it uses to rate limit payment gateway verification requests, allowing unauthenticated attackers to consume the daily allowance and cause legitimate verification attempts to be refused for the next 24 hours.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_