IP Header Spoofing Vulnerability in OOPSpam Anti-Spam Plugin for WordPress

CVE-2025-12094

What is CVE-2025-12094?

The OOPSpam Anti-Spam plugin for WordPress is susceptible to IP Header Spoofing due to its reliance on client-controlled forwarded headers without proper validation. Attackers can exploit this flaw to falsify their IP addresses, evading established IP-based security measures such as blocked IP lists and rate limits. This vulnerability affects all versions of the plugin up to and including 1.2.53, making it crucial for site administrators to apply necessary security patches and implement best practices to mitigate potential threats.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References