IP Header Spoofing Vulnerability in OOPSpam Anti-Spam Plugin for WordPress
CVE-2025-12094
5.3MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 31 October 2025
What is CVE-2025-12094?
The OOPSpam Anti-Spam plugin for WordPress is susceptible to IP Header Spoofing due to its reliance on client-controlled forwarded headers without proper validation. Attackers can exploit this flaw to falsify their IP addresses, evading established IP-based security measures such as blocked IP lists and rate limits. This vulnerability affects all versions of the plugin up to and including 1.2.53, making it crucial for site administrators to apply necessary security patches and implement best practices to mitigate potential threats.
Affected Version(s)
OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA) * <= 1.2.53
References
CVSS V3.1
Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Jonas Benjamin Friedli