Formidable Forms < 6.1 - IP Spoofing

2023-03-0600:00:00

Daniel Ruf

238

wordpress

discussion settings

ip address block

form submission

intercept request

x-forwarded-for header

exploit

EPSS

0.001

Percentile

39.8%

JSON

The plugin uses several potentially untrusted headers to determine the IP address of the client, leading to IP Address spoofing and bypass of anti-spam protections.

1. In WordPress's Settings > Discussion page, add your IP address to the Disallowed Comment Keys field. This will block form submissions from your IP address.
2. Submit the form, and intercept the request. Add the header `X-Forwarded-For: 192.1.2.3` (you may change the IP address to any other address).
3. See that the form submission is not blocked.

EPSS

0.001

Percentile

39.8%

JSON

Related for WPEX-ID:A281F63F-E295-4666-8A08-01B23CD5A744