Unrated
Formidable Forms 6.5 - 6.35 - Unauthenticated Payment Gateway Connect Verification DoS
The Formidable Forms WordPress plugin before 7.0 does not verify the identity of the caller before recording the timestamp it uses to rate limit payment gateway verification requests, allowing unauthenticated attackers to consume the daily allowance and cause legitimate verification attempts to be refused for the next 24 hours.
Announced Group revision 1
Original source ↗CVE-2026-85642
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-85642
Formidable Forms
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "Unknown",
"product": "Formidable Forms",
"versions": [
{
"status": "affected",
"version": "6.5",
"lessThan": "7.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-85642
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #45810 · Revision 1
- Added to Heist Feed
- Publisher date