Formidable Forms CVE-2026-85642

Exploitation requires the target WordPress site to run Formidable Forms 6.5-6.x with a payment gateway configured such that the plugin's rate-limited payment-verification feature is active - sites not processing payments through Formidable Forms are not affected. Given the condition is met, no further prerequisites apply: the verification endpoint records the rate-limit timestamp without authenticating the caller (AV:N/AC:L/PR:N/UI:N), so any remote unauthenticated attacker can trigger it against default configurations. The principal limiting factor is therefore deployment-specific (payment processing must be enabled), not an authentication or user-interaction barrier; impact is further limited to a 24-hour denial of the verification function rather than full site outage.

This is a genuine but bounded availability issue, not a critical system-compromise flaw. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) correctly reflects remote, unauthenticated, low-complexity exploitation with no user interaction, but the A:H rating overstates impact: the defect (CWE-400, uncontrolled resource consumption) only disables payment-gateway verification for 24 hours, not the whole site, so a partial-availability (A:L) view is more honest. Confidence/integrity are untouched (C:N/I:N). Exploitation status is 'publicly available exploit code exists' - a POC is published by WPScan, but there is no CISA KEV listing and no EPSS score in the input, so there is NO evidence of active or widespread exploitation; POC availability must not be conflated with in-the-wild use. No SSVC data was provided. Net: prioritize for sites that actually process payments through Formidable Forms, but treat it below any flaw affecting confidentiality or integrity. EPSS is absent, so probabilistic exploitation likelihood cannot be stated.

An attacker with no account and no user interaction sends repeated unauthenticated requests to the Formidable Forms payment-gateway verification endpoint, which records rate-limit timestamps without verifying the caller's identity. By exhausting the daily verification allowance, the attacker causes all legitimate payment-verification attempts to be refused for the next 24 hours. A public POC exists (WPScan), and the low attack complexity (AC:L) means the abuse requires only crafted HTTP requests.