IP Header Spoofing Vulnerability in OOPSpam Anti-Spam Plugin for WordPress
CVE-2025-12094
5.3MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 31 October 2025
What is CVE-2025-12094?
The OOPSpam Anti-Spam plugin for WordPress is susceptible to IP Header Spoofing due to its reliance on client-controlled forwarded headers without proper validation. Attackers can exploit this flaw to falsify their IP addresses, evading established IP-based security measures such as blocked IP lists and rate limits. This vulnerability affects all versions of the plugin up to and including 1.2.53, making it crucial for site administrators to apply necessary security patches and implement best practices to mitigate potential threats.
Affected Version(s)
OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA) * <= 1.2.53